nightspire
First seen March 12, 2025Active324 claimed victims
The claims below are reproduced as posted by nightspire on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Audit Accounting Advisory Taxes | April 3, 2025 | ransomware_live | — |
| Secretaria de Educacion de Veracruz, SEV | April 1, 2025 | ransomware_live | — |
| InterLOGIC Inc | April 1, 2025 | ransomware_live | — |
| STORT | April 1, 2025 | ransomware_live | — |
| OMCI S.p.a | March 30, 2025 | ransomware_live | — |
| Powiatowy Urząd Pracy w Żorach | March 30, 2025 | ransomware_live | — |
| INI Investments | March 30, 2025 | ransomware_live | — |
| MISR AL MAHABA HOSPITAL | March 24, 2025 | ransomware_live | — |
| SUMITOMOTOOL | March 23, 2025 | ransomware_live | — |
| KHAZMODAN STUDIOS | March 22, 2025 | ransomware_live | — |
| 6ixty8ight | March 18, 2025 | ransomware_live | — |
| Tanaka Electronics Taiwan Co., LTD | March 18, 2025 | ransomware_live | — |
| Bridgewater Retirement Community | March 16, 2025 | ransomware_live | — |
| Sanyo Special Steel India Pvt. Ltd. | March 16, 2025 | ransomware_live | — |
| Hydro-Vacuum S.A. | March 12, 2025 | ransomware_live | — |
| Wilson Re Limited | March 12, 2025 | ransomware_live | — |
| Tanaka Electronics Taiwan Co.,LTD | March 10, 2025 | ransomware_live | — |
| Far East Consortium International Limited | March 8, 2025 | ransomware_live | — |
| Far East Consortium | March 7, 2025 | ransomware_live | — |
| Waihong Environmental Services Limited | March 5, 2025 | ransomware_live | — |
| Business Ledger Limited | March 3, 2025 | ransomware_live | — |
| Raja Ferry Port Public Company Limited | March 3, 2025 | ransomware_live | — |
| Tohpe Corporation | March 1, 2025 | ransomware_live | — |
| Baily International of Atlanta | February 17, 2025 | ransomware_live | — |
← NewerPage 4 of 4
Claim data from ransomware.live and RansomLook (CC BY 4.0).