ransomhouse
First seen June 1, 2021Active224 claimed victims
The claims below are reproduced as posted by ransomhouse on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor "Jolly Scorpius," targeting over 120 organizations across healthcare, finance, transportation, and government, recently upgrading to a multi-layered dual-key encryption architecture.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| [DISCLOSED]Terca | October 13, 2026 | ransomlook | — |
| [DISCLOSED]Hospital Hermilio Valdizán | October 13, 2026 | ransomlook | — |
| Excess Baggage | October 13, 2026 | ransomlook | — |
| Excess Baggage | October 5, 2026 | ransomware_live | — |
| PT Indo Tambangraya Megah | October 2, 2026 | ransomlook | — |
| Hospital Hermilio Valdizán | October 2, 2026 | ransomlook | — |
| Terca | October 1, 2026 | ransomlook | — |
| Pertamina | September 17, 2026 | ransomlook | — |
| Namibian Defence Force | September 17, 2026 | ransomlook | — |
| [DISCLOSED] California School Employees Association | September 15, 2026 | ransomlook | — |
| PT Indo Tambangraya Megah | September 12, 2026 | ransomware_live | — |
| Namibian Defence Force | September 12, 2026 | ransomware_live | — |
| California School Employees Association | September 10, 2026 | ransomlook | — |
| [EVIDENCE]REXT Holdings Co., Ltd. | September 2, 2026 | ransomlook | — |
| REXT Holdings Co., Ltd. | September 1, 2026 | ransomlook | — |
| Terca | August 21, 2026 | ransomware_live | — |
| Hospital Hermilio Valdizán | August 21, 2026 | ransomware_live | — |
| Pertamina | August 21, 2026 | ransomware_live | — |
| California School Employees Association | August 21, 2026 | ransomware_live | — |
| City of McMinnville OR | August 3, 2026 | ransomware_live | — |
| TECHVENTURES BANK S.A. | August 3, 2026 | ransomware_live | — |
| City of Beacon | July 23, 2026 | ransomware_live | — |
| PCL Holding | July 18, 2026 | ransomware_live | — |
| lya Construtora | July 16, 2026 | ransomware_live | — |
| Alya Construtora | July 16, 2026 | ransomware_live | — |
| Nichirei | July 13, 2026 | ransomware_live | — |
| Fidelity Services Group | July 12, 2026 | ransomware_live | — |
| Megawork | July 10, 2026 | ransomware_live | — |
| Bonacio | June 14, 2026 | ransomware_live | — |
| Prince George County | June 10, 2026 | ransomware_live | — |
| Promepla | June 8, 2026 | ransomware_live | — |
| Ma Pak Leung Company Limited | May 23, 2026 | ransomware_live | — |
| Aegle Aviation | May 8, 2026 | ransomware_live | — |
| Cybersecurity Vendor | April 17, 2026 | ransomware_live | — |
| Trellix (McAfee & FireEye) | April 17, 2026 | ransomware_live | — |
| Star Energy Geothermal Salak | April 11, 2026 | ransomware_live | — |
| Winnitex (Americas) Limited | April 8, 2026 | ransomware_live | — |
| Karl Chevrolet | April 3, 2026 | ransomware_live | — |
| Irec Sas | February 28, 2026 | ransomware_live | — |
| Jiangsu Zenergy Battery Technologies Group Co., Ltd. | February 28, 2026 | ransomware_live | — |
| Bioptik Technology | February 26, 2026 | ransomware_live | — |
| Accelerated Services | February 16, 2026 | ransomware_live | — |
| Neinver | February 16, 2026 | ransomware_live | — |
| Transaction Packing Inc | January 31, 2026 | ransomware_live | — |
| Warren County Sheriff’s Office | December 19, 2025 | ransomware_live | — |
| [Weapons License] Warren County Sheriff’s Office | December 19, 2025 | ransomware_live | — |
| [Internal database pack 1] Warren County Sheriff’s Office | December 19, 2025 | ransomware_live | — |
| [Internal database pack 2] Warren County Sheriff’s Office | December 19, 2025 | ransomware_live | — |
| [Internal database pack 4] Warren County Sheriff’s Office | December 19, 2025 | ransomware_live | — |
| Luxshare Precision Industry Co. Ltd. | December 15, 2025 | ransomware_live | — |
| Fedcap | December 10, 2025 | ransomware_live | — |
| Arkan | December 8, 2025 | ransomware_live | — |
| Lawsoft | December 1, 2025 | ransomware_live | — |
| Diaz Gill Medicina Laboratorial S.A. | November 26, 2025 | ransomware_live | — |
| Armis Group | November 20, 2025 | ransomware_live | — |
| Industrial Steam | November 16, 2025 | ransomware_live | — |
| Assolim | November 13, 2025 | ransomware_live | — |
| ESSPL | November 12, 2025 | ransomware_live | — |
| Astrofein | November 7, 2025 | ransomware_live | — |
| Public Safety Mutual Benefit Fund | November 4, 2025 | ransomware_live | — |
| Fulgar S.p.A. | October 31, 2025 | ransomware_live | — |
| Swedish Arts Council | October 31, 2025 | ransomware_live | — |
| Polidano Group | October 30, 2025 | ransomware_live | — |
| Soderstrom Architects, LTD | October 30, 2025 | ransomware_live | — |
| Victorian Chemical | October 23, 2025 | ransomware_live | — |
| UnitedLayer | October 23, 2025 | ransomware_live | — |
| MARCK Industries | October 23, 2025 | ransomware_live | — |
| Vennerhus Weine AG | October 20, 2025 | ransomware_live | — |
| ASKUL | October 19, 2025 | ransomware_live | — |
| [EVIDENCE PACK 2]ASKUL | October 19, 2025 | ransomware_live | — |
| Octomeca Oy | October 19, 2025 | ransomware_live | — |
| [EVIDENCE PACK 3]ASKUL | October 19, 2025 | ransomware_live | — |
| WEBER | October 17, 2025 | ransomware_live | — |
| Makro | October 17, 2025 | ransomware_live | — |
| OCI International Holdings | October 15, 2025 | ransomware_live | — |
| Fucerep | October 14, 2025 | ransomware_live | — |
| Kurogane Kasei Co. | October 10, 2025 | ransomware_live | — |
| Soleol | October 9, 2025 | ransomware_live | — |
| United Lube Oil | September 10, 2025 | ransomware_live | — |
| S Food Co., Ltd. | September 10, 2025 | ransomware_live | — |
| GWP Engineering | August 23, 2025 | ransomware_live | — |
| Weber Flavors | August 15, 2025 | ransomware_live | — |
| M8 Group | August 10, 2025 | ransomware_live | — |
| The Plainview Volunteer FD | August 10, 2025 | ransomware_live | — |
| DLCOSMETICS O.E. | August 6, 2025 | ransomware_live | — |
| Maxell Asia | July 21, 2025 | ransomware_live | — |
| Vinda Group | May 16, 2025 | ransomware_live | — |
| Imedexsa | April 21, 2025 | ransomware_live | — |
| Commune de Jemeppe-sur-Sambre | April 21, 2025 | ransomware_live | — |
| Tri State Electric | April 21, 2025 | ransomware_live | — |
| OeTTINGER Brauerei | April 19, 2025 | ransomware_live | — |
| EUC Sjlland | April 19, 2025 | ransomware_live | — |
| C-Mec | April 10, 2025 | ransomware_live | — |
| Bacton Transport Services | April 10, 2025 | ransomware_live | — |
| Triple Jump | April 10, 2025 | ransomware_live | — |
| Telecontrol | April 1, 2025 | ransomware_live | — |
| [EVIDENCE PACK 2] Telecontrol | April 1, 2025 | ransomware_live | — |
| NEW JERSEY CPA | February 17, 2025 | ransomware_live | — |
| Nationz Technologies Inc. | February 8, 2025 | ransomware_live | — |
| The Loretto Hospital | February 2, 2025 | ransomware_live | — |
Page 1 of 3Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).