ransomhub
First seen February 10, 2024Active841 claimed victims
The claims below are reproduced as posted by ransomhub on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| whychoosebw.com | January 21, 2025 | ransomware_live | — |
| precisionmechsd.com | January 21, 2025 | ransomware_live | — |
| escada.com | January 18, 2025 | ransomware_live | — |
| www.liteputer.com.tw | January 16, 2025 | ransomware_live | — |
| www.solariumrevestimentos.com.br | January 16, 2025 | ransomware_live | — |
| bsegroup.it | January 16, 2025 | ransomware_live | — |
| sportadmin.se | January 16, 2025 | ransomware_live | — |
| www.eurocert.pl | January 15, 2025 | ransomware_live | — |
| Intelservice.com | January 14, 2025 | ransomware_live | — |
| udb.net | January 14, 2025 | ransomware_live | — |
| mi.edu | January 13, 2025 | ransomware_live | — |
| healthcarewithinreach.org | January 13, 2025 | ransomware_live | — |
| xtremmedia.com | January 10, 2025 | ransomware_live | — |
| www.wisesocon.com | January 10, 2025 | ransomware_live | — |
| amerplumb.com | January 10, 2025 | ransomware_live | — |
| drive-lines.com | January 9, 2025 | ransomware_live | — |
| castlehillha.co.uk | January 9, 2025 | ransomware_live | — |
| sahpetrol.com.tr | January 8, 2025 | ransomware_live | — |
| molars.co.ke | January 6, 2025 | ransomware_live | — |
| lianbeng.sg | January 1, 2025 | ransomware_live | — |
| groupegm.com | December 31, 2024 | ransomware_live | — |
| www.metlife.com | December 30, 2024 | ransomware_live | — |
| www.psccorporation.com | December 29, 2024 | ransomware_live | — |
| nigico.gr | December 28, 2024 | ransomware_live | — |
| www.geedingconstruction.com | December 27, 2024 | ransomware_live | — |
| www.alliancemat.com | December 27, 2024 | ransomware_live | — |
| acquafertil.com.br | December 27, 2024 | ransomware_live | — |
| www.fairhallzhang.com | December 27, 2024 | ransomware_live | — |
| diazfoodsolutions.es | December 26, 2024 | ransomware_live | — |
| sensualcollection.com | December 24, 2024 | ransomware_live | — |
| AKConstructors.com | December 24, 2024 | ransomware_live | — |
| www.semfin.com | December 23, 2024 | ransomware_live | — |
| www.groupe-setcar.com.tn | December 21, 2024 | ransomware_live | — |
| www.primalwear.com | December 21, 2024 | ransomware_live | — |
| www.rotaryeng.co.th | December 21, 2024 | ransomware_live | — |
| planetgroup.co.il | December 18, 2024 | ransomware_live | — |
| intellinet-es.com | December 18, 2024 | ransomware_live | — |
| www.mie.com.my | December 18, 2024 | ransomware_live | — |
| www.excelresourcing.co.uk | December 17, 2024 | ransomware_live | — |
| scania.pl | December 16, 2024 | ransomware_live | — |
| SWDAKOTAH.COM | December 16, 2024 | ransomware_live | — |
| bushandburchett.com | December 16, 2024 | ransomware_live | — |
| www.mccoyglobal.com | December 16, 2024 | ransomware_live | — |
| nbleisuretrust.org | December 14, 2024 | ransomware_live | — |
| redknee.com | December 14, 2024 | ransomware_live | — |
| medisecure.com.au | December 14, 2024 | ransomware_live | — |
| choicemg.com | December 14, 2024 | ransomware_live | — |
| gilariver.org | December 14, 2024 | ransomware_live | — |
| www.aflak.com.sa | December 12, 2024 | ransomware_live | — |
| www.temotekstil.com.tr | December 12, 2024 | ransomware_live | — |
| greenscape.us.com | December 10, 2024 | ransomware_live | — |
| womenscare.com | December 10, 2024 | ransomware_live | — |
| inia.es | December 9, 2024 | ransomware_live | — |
| recope.go.cr | December 9, 2024 | ransomware_live | — |
| www.hashem-contracting.com | December 7, 2024 | ransomware_live | — |
| www.leaguecenter.org | December 7, 2024 | ransomware_live | — |
| hanwhacimarron.com | December 5, 2024 | ransomware_live | — |
| www.lasalle.com | December 4, 2024 | ransomware_live | — |
| troxlerlabs.com | December 4, 2024 | ransomware_live | — |
| islandphoto.com | December 4, 2024 | ransomware_live | — |
| www.lasalleinc.com | December 4, 2024 | ransomware_live | — |
| www.goethe-university-frankfurt.de | December 3, 2024 | ransomware_live | — |
| westbornmarket.com | December 3, 2024 | ransomware_live | — |
| marietta-city.org | December 3, 2024 | ransomware_live | — |
| www.marietta-city.org | December 3, 2024 | ransomware_live | — |
| KHKKLOW.com | December 2, 2024 | ransomware_live | — |
| costelloeye.com | December 1, 2024 | ransomware_live | — |
| tascosaofficemachines.com | December 1, 2024 | ransomware_live | — |
| qualitybillingservice.com | December 1, 2024 | ransomware_live | — |
| shapesmfg.com | December 1, 2024 | ransomware_live | — |
| everde.com | November 30, 2024 | ransomware_live | — |
| www.wsgcpa.com | November 30, 2024 | ransomware_live | — |
| www.sefiso-atlantique.fr | November 29, 2024 | ransomware_live | — |
| frigopesca.com.ec | November 29, 2024 | ransomware_live | — |
| Levinlaw.com | November 29, 2024 | ransomware_live | — |
| ppotts.com | November 28, 2024 | ransomware_live | — |
| osmedica.com.ar | November 27, 2024 | ransomware_live | — |
| facilcreditos.co | November 27, 2024 | ransomware_live | — |
| gronercrm.com.br | November 27, 2024 | ransomware_live | — |
| wheelerassoc.com | November 27, 2024 | ransomware_live | — |
| tappi.org | November 27, 2024 | ransomware_live | — |
| alleghenycontract.com | November 27, 2024 | ransomware_live | — |
| times-supermarket.com | November 27, 2024 | ransomware_live | — |
| corenroll.com | November 27, 2024 | ransomware_live | — |
| www.z2data.com | November 27, 2024 | ransomware_live | — |
| reliv.la | November 26, 2024 | ransomware_live | — |
| www.itlindia.com | November 25, 2024 | ransomware_live | — |
| maynard.k12.ma.us | November 25, 2024 | ransomware_live | — |
| minneapolisparks.org | November 25, 2024 | ransomware_live | — |
| yunker.com | November 25, 2024 | ransomware_live | — |
| dienesusa.com | November 25, 2024 | ransomware_live | — |
| parkleigh.com | November 25, 2024 | ransomware_live | — |
| isd109.org | November 25, 2024 | ransomware_live | — |
| karberinsulation.com | November 25, 2024 | ransomware_live | — |
| www.aras-group.ae | November 25, 2024 | ransomware_live | — |
| OfficeZilla.com | November 23, 2024 | ransomware_live | — |
| cal-tool.com | November 22, 2024 | ransomware_live | — |
| www.cobeldarou.com | November 21, 2024 | ransomware_live | — |
| curenta.com | November 21, 2024 | ransomware_live | — |
| scalar.co.il | November 20, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).