ransomhub
First seen February 10, 2024Active841 claimed victims
The claims below are reproduced as posted by ransomhub on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| tkg.com | October 22, 2024 | ransomware_live | — |
| melangesystems.com | October 22, 2024 | ransomware_live | — |
| mkarrari.com.br | October 21, 2024 | ransomware_live | — |
| www.usm.cl | October 21, 2024 | ransomware_live | — |
| internetway.com.br | October 21, 2024 | ransomware_live | — |
| starhealth.in | October 19, 2024 | ransomware_live | — |
| clinicia.com | October 19, 2024 | ransomware_live | — |
| www.qal.com | October 18, 2024 | ransomware_live | — |
| Alqaryahauction.com | October 18, 2024 | ransomware_live | — |
| elnamagnetics.com | October 18, 2024 | ransomware_live | — |
| www.oma.aero | October 18, 2024 | ransomware_live | — |
| Bigpharmacy.com.my | October 17, 2024 | ransomware_live | — |
| www.chiltonisd.org | October 17, 2024 | ransomware_live | — |
| www.proflex.ro | October 17, 2024 | ransomware_live | — |
| Fpapak.org | October 16, 2024 | ransomware_live | — |
| G-plans.com | October 16, 2024 | ransomware_live | — |
| Horsesportireland.ie | October 16, 2024 | ransomware_live | — |
| DoctorsToYou.com | October 16, 2024 | ransomware_live | — |
| transport-system.com | October 16, 2024 | ransomware_live | — |
| Astolabs.com ASTO LABS | October 16, 2024 | ransomware_live | — |
| HiCare.net | October 16, 2024 | ransomware_live | — |
| Astolabs.com | October 16, 2024 | ransomware_live | — |
| paciente.sempremedico.com.br | October 16, 2024 | ransomware_live | — |
| davisbrothersinc.com | October 16, 2024 | ransomware_live | — |
| basarsoft.com.tr | October 15, 2024 | ransomware_live | — |
| powiatjedrzejow.pl | October 15, 2024 | ransomware_live | — |
| www.mabeglobal.com | October 15, 2024 | ransomware_live | — |
| mh-mech.com | October 14, 2024 | ransomware_live | — |
| medicato.com | October 13, 2024 | ransomware_live | — |
| saizeriya.co.jp | October 12, 2024 | ransomware_live | — |
| sizeloveconstruction.com | October 12, 2024 | ransomware_live | — |
| semna.fr | October 12, 2024 | ransomware_live | — |
| peorialawyers.com | October 11, 2024 | ransomware_live | — |
| NextStage.AI | October 11, 2024 | ransomware_live | — |
| yorozu-corp.co.jp | October 11, 2024 | ransomware_live | — |
| medexhco.com | October 10, 2024 | ransomware_live | — |
| www.sym-global.com | October 10, 2024 | ransomware_live | — |
| www.tetco-group.com | October 9, 2024 | ransomware_live | — |
| okcabstract.com | October 8, 2024 | ransomware_live | — |
| mauguio-carnon.com | October 8, 2024 | ransomware_live | — |
| www.resourceinternational.com | October 8, 2024 | ransomware_live | — |
| www.cenergica.com | October 8, 2024 | ransomware_live | — |
| nspproteins.com | October 7, 2024 | ransomware_live | — |
| autodoc.pro | October 7, 2024 | ransomware_live | — |
| trulysmall.com | October 6, 2024 | ransomware_live | — |
| www.fdc.ie | October 6, 2024 | ransomware_live | — |
| www.specialtree.com | October 6, 2024 | ransomware_live | — |
| www.ravencm.com | October 5, 2024 | ransomware_live | — |
| canstarrestorations.com | October 5, 2024 | ransomware_live | — |
| kleberandassociates.com | October 4, 2024 | ransomware_live | — |
| omniboxx.nl | October 4, 2024 | ransomware_live | — |
| blalockcompanies.com | October 4, 2024 | ransomware_live | — |
| www.tigre.gob.ar | October 4, 2024 | ransomware_live | — |
| releese.io | October 3, 2024 | ransomware_live | — |
| winwinza.com | October 3, 2024 | ransomware_live | — |
| www.camelotservices.com | October 3, 2024 | ransomware_live | — |
| www.kersey.net | October 3, 2024 | ransomware_live | — |
| guymontigers.com | October 3, 2024 | ransomware_live | — |
| www.guymontigers.com | October 3, 2024 | ransomware_live | — |
| enterpriseoutsourcing.com | October 2, 2024 | ransomware_live | — |
| www.aristoiclassical.org | October 2, 2024 | ransomware_live | — |
| tectaamerica.com | October 1, 2024 | ransomware_live | — |
| www.icp.pr.gov | September 30, 2024 | ransomware_live | — |
| markdom.com | September 29, 2024 | ransomware_live | — |
| www.baymark.com | September 29, 2024 | ransomware_live | — |
| www.contegritygroup.com | September 28, 2024 | ransomware_live | — |
| rockymountaingastro.com | September 28, 2024 | ransomware_live | — |
| bypeterandpauls.com | September 28, 2024 | ransomware_live | — |
| PipelBiz.com | September 27, 2024 | ransomware_live | — |
| mccartycompany.com | September 27, 2024 | ransomware_live | — |
| gsdwi.org | September 24, 2024 | ransomware_live | — |
| appweb.usinacoruripe.com.br | September 24, 2024 | ransomware_live | — |
| harrispersonalinjury.com | September 23, 2024 | ransomware_live | — |
| bakpilic.com.tr | September 22, 2024 | ransomware_live | — |
| aroma.com.tr | September 20, 2024 | ransomware_live | — |
| Acho.io | September 20, 2024 | ransomware_live | — |
| savannahcandy.com | September 20, 2024 | ransomware_live | — |
| donbosco-landser.net | September 20, 2024 | ransomware_live | — |
| www.bluco.com | September 20, 2024 | ransomware_live | — |
| libertyfirstcu.com | September 19, 2024 | ransomware_live | — |
| avl1.com | September 19, 2024 | ransomware_live | — |
| confidencegroup.com.bd | September 19, 2024 | ransomware_live | — |
| virainsight.com | September 18, 2024 | ransomware_live | — |
| libraries.delaware.gov | September 18, 2024 | ransomware_live | — |
| www.galloway-macleod.co.uk | September 17, 2024 | ransomware_live | — |
| www.taperuvicha.com | September 16, 2024 | ransomware_live | — |
| www.8010urbanliving.com | September 16, 2024 | ransomware_live | — |
| www.tta.cls | September 16, 2024 | ransomware_live | — |
| kryptonresources.com | September 16, 2024 | ransomware_live | — |
| tellurianinc.org | September 16, 2024 | ransomware_live | — |
| topdoctors.com | September 13, 2024 | ransomware_live | — |
| passivecomponent.com | September 13, 2024 | ransomware_live | — |
| mechdyne.com | September 12, 2024 | ransomware_live | — |
| thornton-inc.com | September 12, 2024 | ransomware_live | — |
| www.southeasternretina.com | September 12, 2024 | ransomware_live | — |
| ringpower.com | September 12, 2024 | ransomware_live | — |
| www.naniwa-pump.co.jp | September 11, 2024 | ransomware_live | — |
| www.vbrlogistica.com.br | September 11, 2024 | ransomware_live | — |
| www.nikpol.com.au | September 10, 2024 | ransomware_live | — |
| rollxvans.com | September 10, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).