ransomhub
First seen February 10, 2024Active841 claimed victims
The claims below are reproduced as posted by ransomhub on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.bjurholm.se | May 28, 2024 | ransomware_live | — |
| Christies Auction House - christies.com | May 27, 2024 | ransomware_live | — |
| SIAED.it - HOSTER/DEV FOR ITALY BIGGEST BANKS | May 27, 2024 | ransomware_live | — |
| www.cipl.org.in | May 27, 2024 | ransomware_live | — |
| www.christies.com | May 26, 2024 | ransomware_live | — |
| www.harrisranchbeef.com | May 24, 2024 | ransomware_live | — |
| SIAED.it | May 23, 2024 | ransomware_live | — |
| Brittany Horne | May 21, 2024 | ransomware_live | — |
| ThrottleUp | May 21, 2024 | ransomware_live | — |
| www.eastshoresound.com | May 20, 2024 | ransomware_live | — |
| www.psgbdvor.rs | May 20, 2024 | ransomware_live | — |
| www.throttleup.io | May 20, 2024 | ransomware_live | — |
| www.brittanyhorne.com | May 20, 2024 | ransomware_live | — |
| www.mataderodegijon.es | May 19, 2024 | ransomware_live | — |
| Houston Waste Solutions | May 17, 2024 | ransomware_live | — |
| www.houstonwastesolutions.com | May 17, 2024 | ransomware_live | — |
| East Shore Sound | May 16, 2024 | ransomware_live | — |
| Chuo System Service Co.,Ltd | May 16, 2024 | ransomware_live | — |
| Matadero de Gijón - Biogas energy plant - mataderodegijon.es | May 16, 2024 | ransomware_live | — |
| www.chuoss.co.jp | May 15, 2024 | ransomware_live | — |
| LPDB KUMKM LPDB.ID/LPDB.GO.ID | May 14, 2024 | ransomware_live | — |
| eucatex.com.br | May 14, 2024 | ransomware_live | — |
| 500gb/www.confins.com.br/10kk/BR/Come to chat or we will attack you again. | May 14, 2024 | ransomware_live | — |
| Rocky Mountain Sales | May 14, 2024 | ransomware_live | — |
| www.rockymountainsales.com | May 14, 2024 | ransomware_live | — |
| www.eucatex.com.br | May 14, 2024 | ransomware_live | — |
| OKUANT - okuant.com | May 13, 2024 | ransomware_live | — |
| American Clinical Solutions(acslabtest.com) | May 13, 2024 | ransomware_live | — |
| American Clinical Solutions(acslabtest.com)auctioning | May 13, 2024 | ransomware_live | — |
| www.acslabtest.com | May 13, 2024 | ransomware_live | — |
| www.confins.com.br | May 13, 2024 | ransomware_live | — |
| www.crezit.com | May 10, 2024 | ransomware_live | — |
| Administração do Porto de São Francisco do Sul (APSFS) | May 9, 2024 | ransomware_live | — |
| Kamo Jou Trading | May 7, 2024 | ransomware_live | — |
| ORIUX: Experts in Mobility | May 7, 2024 | ransomware_live | — |
| iseta.fr (institut des Sciences de l'Environnement et des Territoires d'Annecy) | May 7, 2024 | ransomware_live | — |
| www.oriux.com | May 7, 2024 | ransomware_live | — |
| iseta.fr | May 7, 2024 | ransomware_live | — |
| NRS Healthcare | May 6, 2024 | ransomware_live | — |
| Thaayakam LTD | May 6, 2024 | ransomware_live | — |
| City of Neodesha | May 6, 2024 | ransomware_live | — |
| www.neodesha.org | May 6, 2024 | ransomware_live | — |
| www.kamojou.co.za | May 5, 2024 | ransomware_live | — |
| The Islamic Emirat of Afghanistan National Environmental Protection Agency | May 4, 2024 | ransomware_live | — |
| lalengineering | May 4, 2024 | ransomware_live | — |
| www.lalengineering.com | May 4, 2024 | ransomware_live | — |
| www.thaayakam.co.uk | May 4, 2024 | ransomware_live | — |
| Universidad Nacional Autónoma de México | May 3, 2024 | ransomware_live | — |
| extraco.ae | May 2, 2024 | ransomware_live | — |
| www.extraco.ae | May 2, 2024 | ransomware_live | — |
| Mellitah Oil & Gas / Enigas Ly (Eni Electricity, Oil & Gas) | April 29, 2024 | ransomware_live | — |
| polaris-SOLUCIONES TECNOLÓGICAS PARA EMPRESAS -- polaris.es | April 27, 2024 | ransomware_live | — |
| Jutebag | April 26, 2024 | ransomware_live | — |
| Precision Time Systems | April 26, 2024 | ransomware_live | — |
| www.polaris.es | April 26, 2024 | ransomware_live | — |
| www.jutebag.co.uk | April 25, 2024 | ransomware_live | — |
| www.precisiontimesystems.com | April 25, 2024 | ransomware_live | — |
| [Published]Constelacion Savings and Credit Society | April 24, 2024 | ransomware_live | — |
| CORIENT | April 24, 2024 | ransomware_live | — |
| EUROPEANPROF - Expertos en Seguridad y Altura - | April 24, 2024 | ransomware_live | — |
| www.portosaofrancisco.com.br | April 24, 2024 | ransomware_live | — |
| www.europeanprof.es | April 24, 2024 | ransomware_live | — |
| HARMAN - CYNC SOLUTIONS client | April 22, 2024 | ransomware_live | — |
| www.harmanrealtors.com | April 22, 2024 | ransomware_live | — |
| nepa.gov.af&dfr.gov.af | April 22, 2024 | ransomware_live | — |
| CYNC SOLUTIONS - The unexpected target. | April 19, 2024 | ransomware_live | — |
| FábricaInfo | April 18, 2024 | ransomware_live | — |
| Mercatino S.r.l. https://www.mercatinousato.com | April 18, 2024 | ransomware_live | — |
| Mercatino https://www.mercatinousato.com | April 17, 2024 | ransomware_live | — |
| www.fabricainfo.com | April 17, 2024 | ransomware_live | — |
| Grupo Cuevas | April 16, 2024 | ransomware_live | — |
| Change HealthCare - OPTUM Group - United HealthCare Group - FOR SALE | April 16, 2024 | ransomware_live | — |
| Empresa de energía del Bajo Putumayo | April 16, 2024 | ransomware_live | — |
| Design Intoto | April 16, 2024 | ransomware_live | — |
| www.designintoto.com.au | April 16, 2024 | ransomware_live | — |
| www.grupocuevas.es | April 16, 2024 | ransomware_live | — |
| www.eebpsa.com.co | April 13, 2024 | ransomware_live | — |
| Robeson County Sheriff's Office | April 12, 2024 | ransomware_live | — |
| www.robesoncoso.org | April 12, 2024 | ransomware_live | — |
| Baca County Feedyard, Inc | April 9, 2024 | ransomware_live | — |
| www.cyncsolutions.com | April 9, 2024 | ransomware_live | — |
| Change HealthCare - OPTUM Group - United HealthCare Group | April 8, 2024 | ransomware_live | — |
| PHARMACY ETTORE FLORIO SNC - Online Pharmacy Italy | April 8, 2024 | ransomware_live | — |
| www.farmaciaflorio.com | April 8, 2024 | ransomware_live | — |
| www.nrshealthcare.com | April 7, 2024 | ransomware_live | — |
| Better Accounting Solutions | April 6, 2024 | ransomware_live | — |
| Carrozzeria Aretusa srl | April 6, 2024 | ransomware_live | — |
| www.betteraccountingsolutions.com | April 6, 2024 | ransomware_live | — |
| Agencia Host | April 5, 2024 | ransomware_live | — |
| Constelacion Savings and Credit Society | April 4, 2024 | ransomware_live | — |
| www.aretusamilano.it | April 4, 2024 | ransomware_live | — |
| www.agenciahost.com | April 3, 2024 | ransomware_live | — |
| www.constelacion.com.sv | April 2, 2024 | ransomware_live | — |
| eni.com&mellitahog.ly | March 29, 2024 | ransomware_live | — |
| Avant IT Norway | March 28, 2024 | ransomware_live | — |
| www.avantit.no | March 28, 2024 | ransomware_live | — |
| Woodsboro ISD | March 26, 2024 | ransomware_live | — |
| Power Generation Engineering and Services Company (PGESCo) - pgesco.com | March 22, 2024 | ransomware_live | — |
| www.pgesco.com | March 22, 2024 | ransomware_live | — |
| www.wisd.net | March 22, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).