ransomhub
First seen February 10, 2024Active841 claimed victims
The claims below are reproduced as posted by ransomhub on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.dalgroup.com | November 20, 2024 | ransomware_live | — |
| tabocas.com.br | November 20, 2024 | ransomware_live | — |
| jindalgroup.com | November 20, 2024 | ransomware_live | — |
| 3ccaresystems.com | November 19, 2024 | ransomware_live | — |
| Thebike.com | November 19, 2024 | ransomware_live | — |
| interborosd.org | November 19, 2024 | ransomware_live | — |
| citywestcommercials.co.uk | November 19, 2024 | ransomware_live | — |
| hartmannbund.de | November 19, 2024 | ransomware_live | — |
| brylesresearch.com | November 19, 2024 | ransomware_live | — |
| tempaircompany.com | November 19, 2024 | ransomware_live | — |
| chsplumbing.com | November 19, 2024 | ransomware_live | — |
| smawins.net | November 19, 2024 | ransomware_live | — |
| polaraire.com | November 19, 2024 | ransomware_live | — |
| walkingtree.org | November 19, 2024 | ransomware_live | — |
| www.fibrogen.com | November 19, 2024 | ransomware_live | — |
| www.iscinc93.com | November 19, 2024 | ransomware_live | — |
| waive.com.au | November 18, 2024 | ransomware_live | — |
| Jornstax.com | November 18, 2024 | ransomware_live | — |
| wulffco.com | November 18, 2024 | ransomware_live | — |
| allconstructiongroupwv.com | November 17, 2024 | ransomware_live | — |
| sealevelinc.com | November 17, 2024 | ransomware_live | — |
| jergenspiping.com | November 16, 2024 | ransomware_live | — |
| totaldevelopmentsolutions.com | November 16, 2024 | ransomware_live | — |
| www.damcapital.in | November 16, 2024 | ransomware_live | — |
| www.kiswire.com | November 16, 2024 | ransomware_live | — |
| potteau.com | November 15, 2024 | ransomware_live | — |
| jhs.co.uk | November 15, 2024 | ransomware_live | — |
| www.gob.mx | November 15, 2024 | ransomware_live | — |
| blr.com | November 14, 2024 | ransomware_live | — |
| tekni-plex.com | November 14, 2024 | ransomware_live | — |
| www.tekni-plex.com | November 14, 2024 | ransomware_live | — |
| fortinainvestments.com | November 13, 2024 | ransomware_live | — |
| bolognafc.it | November 12, 2024 | ransomware_live | — |
| tolbertlegal.com | November 11, 2024 | ransomware_live | — |
| comarchs.com | November 11, 2024 | ransomware_live | — |
| potteau.be | November 11, 2024 | ransomware_live | — |
| interlabel.be | November 8, 2024 | ransomware_live | — |
| bartleycorp.com | November 8, 2024 | ransomware_live | — |
| www.bent-tree.com | November 8, 2024 | ransomware_live | — |
| www.giorgiovisconti.it | November 8, 2024 | ransomware_live | — |
| nelconinc.biz | November 7, 2024 | ransomware_live | — |
| del-electric.com | November 7, 2024 | ransomware_live | — |
| thinkecs.com | November 7, 2024 | ransomware_live | — |
| arcoexc.com | November 6, 2024 | ransomware_live | — |
| brandenburgerplumbing.com | November 6, 2024 | ransomware_live | — |
| www.msdl.ca | November 6, 2024 | ransomware_live | — |
| www.depewgillen.com | November 6, 2024 | ransomware_live | — |
| apoyoconsultoria.com | November 5, 2024 | ransomware_live | — |
| nwhealthporter.com | November 5, 2024 | ransomware_live | — |
| pacificglazing.com | November 5, 2024 | ransomware_live | — |
| sector5.ro | November 5, 2024 | ransomware_live | — |
| metroelectric.com | November 5, 2024 | ransomware_live | — |
| bitquail.com | November 5, 2024 | ransomware_live | — |
| mpdory.com | November 5, 2024 | ransomware_live | — |
| redphoenixconstruction.com | November 4, 2024 | ransomware_live | — |
| csucontracting.com | November 4, 2024 | ransomware_live | — |
| fullfordelectric.com | November 4, 2024 | ransomware_live | — |
| www.mssupply.com | November 4, 2024 | ransomware_live | — |
| www.drbutlerandassociates.com | November 4, 2024 | ransomware_live | — |
| www.schweiker.de | November 4, 2024 | ransomware_live | — |
| kenanasugarcompany.com | November 4, 2024 | ransomware_live | — |
| goodline.com.au | November 4, 2024 | ransomware_live | — |
| maxdata.com.br | November 4, 2024 | ransomware_live | — |
| sundt.com | November 4, 2024 | ransomware_live | — |
| lambertstonecommercial.com | November 3, 2024 | ransomware_live | — |
| caseconstruction.com | November 3, 2024 | ransomware_live | — |
| krigerconstruction.com | November 3, 2024 | ransomware_live | — |
| bravodigitaltrader.co.uk | November 2, 2024 | ransomware_live | — |
| eap.gr | November 1, 2024 | ransomware_live | — |
| www.fatboysfleetandauto.com | November 1, 2024 | ransomware_live | — |
| nynewspapers.com | November 1, 2024 | ransomware_live | — |
| www.d47.org | October 31, 2024 | ransomware_live | — |
| nagucoop.com | October 30, 2024 | ransomware_live | — |
| tlie.org | October 30, 2024 | ransomware_live | — |
| illumin8global.com | October 30, 2024 | ransomware_live | — |
| pro-mec.com | October 30, 2024 | ransomware_live | — |
| asesoriacamen.es | October 30, 2024 | ransomware_live | — |
| www.ztexconstruction.com | October 29, 2024 | ransomware_live | — |
| hcfinc.com | October 29, 2024 | ransomware_live | — |
| geminiindustriesinc.com | October 29, 2024 | ransomware_live | — |
| www.ua4rent.com | October 28, 2024 | ransomware_live | — |
| payxpress.co.il | October 27, 2024 | ransomware_live | — |
| noblehouse.com.ph | October 27, 2024 | ransomware_live | — |
| obe.com | October 27, 2024 | ransomware_live | — |
| www.rosito-bisani.com | October 27, 2024 | ransomware_live | — |
| Medigroup.ca | October 27, 2024 | ransomware_live | — |
| flueid.com | October 26, 2024 | ransomware_live | — |
| granjazul.com | October 26, 2024 | ransomware_live | — |
| lighthouseelectric.com | October 26, 2024 | ransomware_live | — |
| Groupseco.com | October 25, 2024 | ransomware_live | — |
| www.olanocorp.com | October 25, 2024 | ransomware_live | — |
| www.kciconst.com | October 24, 2024 | ransomware_live | — |
| bulloch.solutions | October 23, 2024 | ransomware_live | — |
| coppelltx.gov | October 23, 2024 | ransomware_live | — |
| 1doc.sg | October 22, 2024 | ransomware_live | — |
| specpro-inc.com | October 22, 2024 | ransomware_live | — |
| dennissupply.com | October 22, 2024 | ransomware_live | — |
| polypane.be | October 22, 2024 | ransomware_live | — |
| bwdtechnology.com | October 22, 2024 | ransomware_live | — |
| lpahorticole.faylbillot.educagri.fr | October 22, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).