orion
First seen January 14, 2026Active14 claimed victims
The claims below are reproduced as posted by orion on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Orion is a ransomware operation first observed in October 2025 that listed 13 alleged victims on a dark web leak site across financial services, manufacturing, and healthcare, though analysts determined its victim list was recycled from prior LockBit and BlackCat disclosures rather than fresh compromises.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Nitrex Chemicals India | July 27, 2026 | ransomware_live | — |
| pricemodern.com | October 28, 2025 | ransomware_live | — |
| morrisgroupint.com | October 28, 2025 | ransomware_live | — |
| daubertchemical.com | October 28, 2025 | ransomware_live | — |
| emanic.net | October 28, 2025 | ransomware_live | — |
| udhaiyamdhall.com | October 28, 2025 | ransomware_live | — |
| kioti.com | October 28, 2025 | ransomware_live | — |
| sitrack.com | October 28, 2025 | ransomware_live | — |
| hetero.com | October 28, 2025 | ransomware_live | — |
| ipsenlogistics.com | October 28, 2025 | ransomware_live | — |
| albanybank.com | October 28, 2025 | ransomware_live | — |
| bridgestoneamericas.com | October 28, 2025 | ransomware_live | — |
| hphood.com | October 28, 2025 | ransomware_live | — |
| huntongroup.com | October 28, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).