ransomexx
First seen May 14, 2020Active86 claimed victims
The claims below are reproduced as posted by ransomexx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Go2Joy (go2joy.vn) | June 20, 2026 | ransomware_live | — |
| SOGO Auction | April 17, 2026 | ransomware_live | — |
| GoTip | April 16, 2026 | ransomware_live | — |
| ADDA (adda.io) | March 7, 2025 | ransomware_live | — |
| Makesworth Accountants | February 9, 2025 | ransomware_live | — |
| Lakeshore Title Agency | January 31, 2025 | ransomware_live | — |
| Grupo Vargas | December 21, 2024 | ransomware_live | — |
| Retemex | September 14, 2024 | ransomware_live | — |
| Brontoo Technology Solutions | August 10, 2024 | ransomware_live | — |
| nursing.com | August 3, 2024 | ransomware_live | — |
| LITEON | July 26, 2024 | ransomware_live | — |
| Planet Group International | July 26, 2024 | ransomware_live | — |
| Wagner-Meinert | July 8, 2024 | ransomware_live | — |
| Asteco | April 17, 2024 | ransomware_live | — |
| Ministry of Defense of Peru | March 24, 2024 | ransomware_live | — |
| Kenya Airways | December 30, 2023 | ransomware_live | — |
| AlJaber Engineering | November 26, 2023 | ransomware_live | — |
| Admilla ELAP | November 17, 2023 | ransomware_live | — |
| Telecommunications Services of Trinidad and Tobago (tstt.co.tt) | October 27, 2023 | ransomware_live | — |
| Telecommunications Services of Trinidad and Tobago | October 27, 2023 | ransomware_live | — |
| DVA - DVision Architecture | July 1, 2023 | ransomware_live | — |
| DVision Architecture | July 1, 2023 | ransomware_live | — |
| Jacobs Farm | June 24, 2023 | ransomware_live | — |
| Jacobs Farm / Del Cabo | June 24, 2023 | ransomware_live | — |
| Bettuzzi And Partners | March 2, 2023 | ransomware_live | — |
| BULOG | February 22, 2023 | ransomware_live | — |
| Badan Urusan Logistik | February 22, 2023 | ransomware_live | — |
| REC Silicon | December 11, 2022 | ransomware_live | — |
| Unimed Belem | October 19, 2022 | ransomware_live | — |
| Consorci Sanitari Integral & Geseme | October 11, 2022 | ransomware_live | — |
| Consorci Sanitari Integral | October 11, 2022 | ransomware_live | — |
| Ferrari | October 2, 2022 | ransomware_live | — |
| Bombardier Recreational Products (BRP) - SOURCE CODES | October 1, 2022 | ransomware_live | — |
| Fundo Nacional de Desenvolvimento da Educação | September 3, 2022 | ransomware_live | — |
| Bombardier Recreational Products (BRP) - BONUS CONTENT (!!!) | August 24, 2022 | ransomware_live | — |
| Bombardier Recreational Products (BRP) | August 23, 2022 | ransomware_live | — |
| Bombardier Recreational Products | August 23, 2022 | ransomware_live | — |
| Sonae | April 5, 2022 | ransomware_live | — |
| Stago | March 29, 2022 | ransomware_live | — |
| Scottish Association for Mental Health | March 20, 2022 | ransomware_live | — |
| Viva Air | March 14, 2022 | ransomware_live | — |
| Diagnostica Stago | March 1, 2022 | ransomware_live | — |
| POP TV | February 15, 2022 | ransomware_live | — |
| KCA Deutag | January 28, 2022 | ransomware_live | — |
| Hellmann Worldwide Logistics | December 15, 2021 | ransomware_live | — |
| UMW Group | December 10, 2021 | ransomware_live | — |
| Ruwac | December 6, 2021 | ransomware_live | — |
| Ruwac Industrial Vacuums | December 6, 2021 | ransomware_live | — |
| Unione dei Comuni Terre di Pianura | November 16, 2021 | ransomware_live | — |
| Digicel Group | October 24, 2021 | ransomware_live | — |
| Unione Reno Galliera | September 26, 2021 | ransomware_live | — |
| United Carton Industries Company Ltd | September 20, 2021 | ransomware_live | — |
| United Carton Industries Company | September 20, 2021 | ransomware_live | — |
| American Megatrends International | September 9, 2021 | ransomware_live | — |
| Gigabyte Technology | September 9, 2021 | ransomware_live | — |
| Ermenegildo Zegna Holding | September 9, 2021 | ransomware_live | — |
| Liberty Group & ForHousing | September 9, 2021 | ransomware_live | — |
| Corporación Nacional de Telecomunicación | September 9, 2021 | ransomware_live | — |
| Walsin | September 9, 2021 | ransomware_live | — |
| WT Microelectronics | September 9, 2021 | ransomware_live | — |
| Universal Assistance S.A. | September 9, 2021 | ransomware_live | — |
| STEMCOR | September 9, 2021 | ransomware_live | — |
| Wallace & Carey | September 9, 2021 | ransomware_live | — |
| Samvardhana Motherson Peguform | September 9, 2021 | ransomware_live | — |
| Nobiskrug | September 9, 2021 | ransomware_live | — |
| Ajuntament de Castelló | September 9, 2021 | ransomware_live | — |
| Consiglio Nazionale del Notariato | September 9, 2021 | ransomware_live | — |
| Pertamina EP | September 9, 2021 | ransomware_live | — |
| CalAmp (NASDAQ: CAMP) | September 9, 2021 | ransomware_live | — |
| Soluzioni Infrastrutturali Telefoniche ed Elettriche S.p.A. | September 9, 2021 | ransomware_live | — |
| Indura SA | September 9, 2021 | ransomware_live | — |
| Vistra | September 9, 2021 | ransomware_live | — |
| Ultrapar Participações S.A. | September 9, 2021 | ransomware_live | — |
| Gigabyte | August 3, 2021 | ransomware_live | — |
| Lazio Region in Italy | July 31, 2021 | ransomware_live | — |
| Corporación Nacional de Telecomunicación (CNT) | July 12, 2021 | ransomware_live | — |
| Mutuelle Nationale des Hospitaliers (MNH) | February 5, 2021 | ransomware_live | — |
| Inchcape | December 14, 2020 | ransomware_live | — |
| Brazil’s Superior Tribunal de Justiça (Court System) | November 3, 2020 | ransomware_live | — |
| Société de transport de Montréal (STM) (public transport agency) | October 19, 2020 | ransomware_live | — |
| Tyler Technologies | September 23, 2020 | ransomware_live | — |
| IPG Photonics | September 14, 2020 | ransomware_live | — |
| SoftServe | September 1, 2020 | ransomware_live | — |
| R1 RCM (medical debt collection firm) | August 1, 2020 | ransomware_live | — |
| Konica Minolta | July 30, 2020 | ransomware_live | — |
| Texas Department of Transportation | May 14, 2020 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).