ransomhub
First seen February 10, 2024Active841 claimed victims
The claims below are reproduced as posted by ransomhub on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.unige.it | September 9, 2024 | ransomware_live | — |
| rarholding.com | September 9, 2024 | ransomware_live | — |
| www.dpe.go.th | September 7, 2024 | ransomware_live | — |
| www.atlcc.net | September 7, 2024 | ransomware_live | — |
| americagraphics.com | September 6, 2024 | ransomware_live | — |
| www.parknfly.ca | September 5, 2024 | ransomware_live | — |
| kawasaki.eu | September 5, 2024 | ransomware_live | — |
| inorde.com | September 5, 2024 | ransomware_live | — |
| cps-k12.org | September 5, 2024 | ransomware_live | — |
| briedis.lt | September 5, 2024 | ransomware_live | — |
| advbe.com | September 5, 2024 | ransomware_live | — |
| www.careco.se | September 5, 2024 | ransomware_live | — |
| plannedparenthood.org | September 4, 2024 | ransomware_live | — |
| www.pcipa.com | September 4, 2024 | ransomware_live | — |
| www.galgorm.com | September 4, 2024 | ransomware_live | — |
| domainindustries.com | September 4, 2024 | ransomware_live | — |
| www.plumbersstock.com | September 3, 2024 | ransomware_live | — |
| www.sanyo-av.com | September 2, 2024 | ransomware_live | — |
| Removal.AI | September 2, 2024 | ransomware_live | — |
| ironmetals.com | September 2, 2024 | ransomware_live | — |
| cbt-gmbh.de | September 1, 2024 | ransomware_live | — |
| qs-group.com | September 1, 2024 | ransomware_live | — |
| www.nissan-dubai.com | August 31, 2024 | ransomware_live | — |
| phdservices.net | August 31, 2024 | ransomware_live | — |
| www.bsg.com.au | August 31, 2024 | ransomware_live | — |
| www.citebd.org | August 30, 2024 | ransomware_live | — |
| www.iph-bet.fr | August 30, 2024 | ransomware_live | — |
| www.primariatm.ro | August 30, 2024 | ransomware_live | — |
| www.mineduc.gob.gt | August 30, 2024 | ransomware_live | — |
| grant-associates.uk.com | August 30, 2024 | ransomware_live | — |
| Inglenorth.co.uk | August 30, 2024 | ransomware_live | — |
| capecodacademy.org | August 30, 2024 | ransomware_live | — |
| www.tokiwa-group.co.jp | August 30, 2024 | ransomware_live | — |
| ciot.com | August 29, 2024 | ransomware_live | — |
| cardiovirginia.com | August 29, 2024 | ransomware_live | — |
| wilmingtoncc.org | August 28, 2024 | ransomware_live | — |
| www.bennettcurrie.co.nz | August 28, 2024 | ransomware_live | — |
| www.vinatiorganics.com | August 28, 2024 | ransomware_live | — |
| oipip.gda.pl | August 28, 2024 | ransomware_live | — |
| www.law-taxes.pl | August 28, 2024 | ransomware_live | — |
| www.polycohealthline.com | August 27, 2024 | ransomware_live | — |
| dpfza.gov.dj | August 27, 2024 | ransomware_live | — |
| www.adantia.es | August 27, 2024 | ransomware_live | — |
| www.faithfc.org | August 27, 2024 | ransomware_live | — |
| htsusa.com | August 26, 2024 | ransomware_live | — |
| www.smarterp.com | August 26, 2024 | ransomware_live | — |
| rainierarms.com | August 26, 2024 | ransomware_live | — |
| lafuturasrl.it | August 25, 2024 | ransomware_live | — |
| www.pokerspa.it | August 24, 2024 | ransomware_live | — |
| saudi arabia(general secretariat of the military service council) | August 22, 2024 | ransomware_live | — |
| www.iiitd.ac.in | August 22, 2024 | ransomware_live | — |
| www.lfewines.com | August 22, 2024 | ransomware_live | — |
| Appellation vins fins | August 22, 2024 | ransomware_live | — |
| accuraterailroad.com | August 22, 2024 | ransomware_live | — |
| www.banhampoultry.co.uk | August 21, 2024 | ransomware_live | — |
| www.ramoncorripio.com | August 21, 2024 | ransomware_live | — |
| www.suvacity.org | August 21, 2024 | ransomware_live | — |
| inlighten.net | August 20, 2024 | ransomware_live | — |
| capitalfund1.com | August 20, 2024 | ransomware_live | — |
| www.sanyo-bussan.co.jp | August 20, 2024 | ransomware_live | — |
| allamericanpoly.com | August 20, 2024 | ransomware_live | — |
| advantagecdc.org | August 20, 2024 | ransomware_live | — |
| OSG.COM | August 19, 2024 | ransomware_live | — |
| www.spie-tec.de | August 19, 2024 | ransomware_live | — |
| www.schneider.ch | August 18, 2024 | ransomware_live | — |
| www.regentcaravans.com.au | August 17, 2024 | ransomware_live | — |
| www.martinswood.herts.sch.uk | August 17, 2024 | ransomware_live | — |
| www.allanmcneill.co.nz | August 17, 2024 | ransomware_live | — |
| www.lennartsfors.com | August 17, 2024 | ransomware_live | — |
| www.albynhousing.org.uk | August 17, 2024 | ransomware_live | — |
| glasstile.com | August 17, 2024 | ransomware_live | — |
| www.patelco.org | August 16, 2024 | ransomware_live | — |
| blowerdempsay.com | August 16, 2024 | ransomware_live | — |
| tri-tech.us | August 16, 2024 | ransomware_live | — |
| www.atwoodcherny.com | August 15, 2024 | ransomware_live | — |
| www.isnart.it | August 15, 2024 | ransomware_live | — |
| www.aaconsultinc.com | August 15, 2024 | ransomware_live | — |
| nrcollecties.nl | August 15, 2024 | ransomware_live | — |
| gardenhomesmanagement.com | August 15, 2024 | ransomware_live | — |
| www.towellengineering.net | August 15, 2024 | ransomware_live | — |
| www.quenotedeporten.com | August 15, 2024 | ransomware_live | — |
| police.praca.gov.pl | August 14, 2024 | ransomware_live | — |
| ljglaw.com | August 14, 2024 | ransomware_live | — |
| imobesidade.com.br | August 14, 2024 | ransomware_live | — |
| www.chwa.com.tw | August 13, 2024 | ransomware_live | — |
| bedford.k12.oh.us | August 12, 2024 | ransomware_live | — |
| Jeffersoncountyclerk.org | August 11, 2024 | ransomware_live | — |
| naturalcuriosities.com | August 11, 2024 | ransomware_live | — |
| www.swinburne.edu | August 11, 2024 | ransomware_live | — |
| www.wmwmeyer.com | August 10, 2024 | ransomware_live | — |
| prasarana.com.my | August 10, 2024 | ransomware_live | — |
| dhcgrp.com | August 9, 2024 | ransomware_live | — |
| rationalenterprise.com | August 8, 2024 | ransomware_live | — |
| golfoy.com | August 8, 2024 | ransomware_live | — |
| amplicon.com | August 7, 2024 | ransomware_live | — |
| www.jgsummit.com.ph | August 7, 2024 | ransomware_live | — |
| infotexim.pe | August 6, 2024 | ransomware_live | — |
| pierrediamonds.com.au | August 6, 2024 | ransomware_live | — |
| www.sobha.com | August 4, 2024 | ransomware_live | — |
| modernceramics.com | August 2, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).