ransomhub
First seen February 10, 2024Active841 claimed victims
The claims below are reproduced as posted by ransomhub on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.gruyeria.ch | August 1, 2024 | ransomware_live | — |
| www.pharm-int.com | July 31, 2024 | ransomware_live | — |
| nydj.com | July 31, 2024 | ransomware_live | — |
| biggreenegg.com | July 31, 2024 | ransomware_live | — |
| wgma.org | July 31, 2024 | ransomware_live | — |
| effinghamschools.com | July 31, 2024 | ransomware_live | — |
| www.bahia-principe.com | July 31, 2024 | ransomware_live | — |
| inv-dar.com | July 31, 2024 | ransomware_live | — |
| www.netconfig.co.za | July 31, 2024 | ransomware_live | — |
| www.gmchc.org | July 31, 2024 | ransomware_live | — |
| www.fenceauthority.com | July 31, 2024 | ransomware_live | — |
| udch.in.th | July 30, 2024 | ransomware_live | — |
| welevelup.com | July 30, 2024 | ransomware_live | — |
| verwarmingheyndrickx.be | July 30, 2024 | ransomware_live | — |
| hudsoncivil.com.au | July 30, 2024 | ransomware_live | — |
| alliuminteriors.co.nz | July 30, 2024 | ransomware_live | — |
| www.manotherm.ie | July 30, 2024 | ransomware_live | — |
| labor-koblenz.de | July 29, 2024 | ransomware_live | — |
| www.electriforce.com | July 27, 2024 | ransomware_live | — |
| www.castelligroup.com | July 26, 2024 | ransomware_live | — |
| www.johnkellys.com | July 26, 2024 | ransomware_live | — |
| baytoti.com | July 25, 2024 | ransomware_live | — |
| panitchlaw.com | July 25, 2024 | ransomware_live | — |
| oficina.oficinadasfinancas.com.br | July 24, 2024 | ransomware_live | — |
| sigmacontrol.eu | July 23, 2024 | ransomware_live | — |
| bpjaguar.com | July 23, 2024 | ransomware_live | — |
| ach.co.th | July 23, 2024 | ransomware_live | — |
| www.neurologicalinstitute.com | July 22, 2024 | ransomware_live | — |
| retaildatallc.com | July 22, 2024 | ransomware_live | — |
| www.garudafood.com | July 20, 2024 | ransomware_live | — |
| www.byzan.com | July 20, 2024 | ransomware_live | — |
| pgd.pl | July 18, 2024 | ransomware_live | — |
| ccsdschools.com | July 18, 2024 | ransomware_live | — |
| www.cameronhodges.com | July 16, 2024 | ransomware_live | — |
| ceopag.com.br / ceofood.com.br | July 16, 2024 | ransomware_live | — |
| www.hlbpr.com | July 16, 2024 | ransomware_live | — |
| www.newcastlewa.gov | July 16, 2024 | ransomware_live | — |
| metalfrio.com.br | July 16, 2024 | ransomware_live | — |
| www.glowfm.nl | July 16, 2024 | ransomware_live | — |
| mrhme.org | July 16, 2024 | ransomware_live | — |
| hlbpr.com | July 16, 2024 | ransomware_live | — |
| www.erma-rtmo.it | July 14, 2024 | ransomware_live | — |
| lmgroup.com | July 14, 2024 | ransomware_live | — |
| www.bfcsolutions.com | July 11, 2024 | ransomware_live | — |
| www.riteaid.com | July 11, 2024 | ransomware_live | — |
| www.normandydiesel.fr | July 11, 2024 | ransomware_live | — |
| www.alabamaplate.com | July 9, 2024 | ransomware_live | — |
| mcdowallaffleck.com.au | July 8, 2024 | ransomware_live | — |
| www.swcs-inc.com | July 3, 2024 | ransomware_live | — |
| hcri.edu | July 3, 2024 | ransomware_live | — |
| cminsulation.com | July 3, 2024 | ransomware_live | — |
| www.daesangamerica.com | July 2, 2024 | ransomware_live | — |
| www.zepter.de | July 2, 2024 | ransomware_live | — |
| www.whittakersystem.com | July 1, 2024 | ransomware_live | — |
| www.hauptmann.at | June 29, 2024 | ransomware_live | — |
| www.finecopneumatica.com | June 29, 2024 | ransomware_live | — |
| www.benchinternational.com | June 29, 2024 | ransomware_live | — |
| Spandex.com | June 28, 2024 | ransomware_live | — |
| floridahealth.gov | June 28, 2024 | ransomware_live | — |
| baiminstitute.org | June 28, 2024 | ransomware_live | — |
| www.baiminstitute.org | June 28, 2024 | ransomware_live | — |
| midamea.com | June 27, 2024 | ransomware_live | — |
| midamea.comAuction | June 27, 2024 | ransomware_live | — |
| daniellegroup.com | June 26, 2024 | ransomware_live | — |
| equinocioplay.com.br | June 24, 2024 | ransomware_live | — |
| coca-cola.com - Myanmar office | June 23, 2024 | ransomware_live | — |
| www.cloudeurope.it | June 22, 2024 | ransomware_live | — |
| kempe.com.au | June 21, 2024 | ransomware_live | — |
| www.gbricambi.it [UPDATE] | June 20, 2024 | ransomware_live | — |
| www.invisio.com | June 19, 2024 | ransomware_live | — |
| www.sfmedical.de | June 19, 2024 | ransomware_live | — |
| aedifica.com | June 19, 2024 | ransomware_live | — |
| www.eurostrand.de | June 19, 2024 | ransomware_live | — |
| www.domainatcleveland.com | June 17, 2024 | ransomware_live | — |
| www.liderit.es | June 17, 2024 | ransomware_live | — |
| www.gbricambi.it | June 17, 2024 | ransomware_live | — |
| bitzsoftwares.com.br | June 17, 2024 | ransomware_live | — |
| www.netavent.dk | June 17, 2024 | ransomware_live | — |
| www.lynchaluminum.com | June 17, 2024 | ransomware_live | — |
| www.nttdata.ro | June 15, 2024 | ransomware_live | — |
| www.amberbev.com | June 14, 2024 | ransomware_live | — |
| www.racalacoustics.com | June 13, 2024 | ransomware_live | — |
| www.racalacoustics.com [UPDATE] | June 13, 2024 | ransomware_live | — |
| multi-wing.com | June 13, 2024 | ransomware_live | — |
| www.timortelecom.tl | June 12, 2024 | ransomware_live | — |
| www.ham.org.br | June 11, 2024 | ransomware_live | — |
| smicusa.com | June 11, 2024 | ransomware_live | — |
| www.novabitsrl.it | June 11, 2024 | ransomware_live | — |
| parlorenzo.com | June 10, 2024 | ransomware_live | — |
| www.vinakom.com | June 10, 2024 | ransomware_live | — |
| www.ugrocapital.com | June 5, 2024 | ransomware_live | — |
| www.mangimifusco.it | June 2, 2024 | ransomware_live | — |
| Frontier | June 1, 2024 | ransomware_live | — |
| Frontier.com | June 1, 2024 | ransomware_live | — |
| www.sicoob.com.br | June 1, 2024 | ransomware_live | — |
| www.clevo.com.tw | May 29, 2024 | ransomware_live | — |
| www.clevo.com.tw<UPDATED> | May 29, 2024 | ransomware_live | — |
| www.clevo.com.twDisclose | May 29, 2024 | ransomware_live | — |
| PSG BANATSKI DVOR D.O.O. NOVI SAD (SERBIA) | May 28, 2024 | ransomware_live | — |
| Bjurholms kommun | May 28, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).