revil
First seen August 26, 2019Active96 claimed victims
The claims below are reproduced as posted by revil on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Sunknowledge Services Inc | November 28, 2022 | ransomware_live | — |
| kusd.edu | November 28, 2022 | ransomware_live | — |
| medibank.com.au | November 7, 2022 | ransomware_live | — |
| Midea Group | September 1, 2022 | ransomware_live | — |
| Doosan Group | August 2, 2022 | ransomware_live | — |
| OptiProERP is a leading global provider of industry-specific ERP solutions for manufacture | July 25, 2022 | ransomware_live | — |
| Ludwig Freytag Group | May 12, 2022 | ransomware_live | — |
| Unicity International | May 3, 2022 | ransomware_live | — |
| Stratford University | April 22, 2022 | ransomware_live | — |
| www.oil-india.com | April 21, 2022 | ransomware_live | — |
| CYMZ | April 21, 2022 | ransomware_live | — |
| Asfaltproductienijmegen | April 21, 2022 | ransomware_live | — |
| Visotec Group www.visotec.com | April 20, 2022 | ransomware_live | — |
| PTT Exploration and Production - 720GB | October 15, 2021 | ransomware_live | — |
| ECKERD PERU S.A, INKAFARMA, MIFARMA | October 8, 2021 | ransomware_live | — |
| Join us on RAMP | October 7, 2021 | ransomware_live | — |
| Ronmor Holdings | October 1, 2021 | ransomware_live | — |
| Fimmick CRM Honk Kong (www.fimmick.com) | September 30, 2021 | ransomware_live | — |
| Fimmick CRM Hong Kong (www.fimmick.com) | September 30, 2021 | ransomware_live | — |
| Spiezle Architectural Group Inc. | September 16, 2021 | ransomware_live | — |
| ohiograting.com | September 11, 2021 | ransomware_live | — |
| ensingerplastics.com | September 9, 2021 | ransomware_live | — |
| South Carolina Legal Services breach | September 9, 2021 | ransomware_live | — |
| lstaff.com / atworksprofessional / atworks.com | September 9, 2021 | ransomware_live | — |
| Primo Water | September 9, 2021 | ransomware_live | — |
| inocean.no / 2000 GB | September 9, 2021 | ransomware_live | — |
| Hx5, LLC | September 9, 2021 | ransomware_live | — |
| Daylesford - BHoldings - Bamford - The Wild Rabbit | September 9, 2021 | ransomware_live | — |
| KASEYA ATTACK INFO | September 9, 2021 | ransomware_live | — |
| kuk.de / KREBS + KIEFER / 500GB | September 9, 2021 | ransomware_live | — |
| neroindustry.com | September 9, 2021 | ransomware_live | — |
| Gosiger | September 9, 2021 | ransomware_live | — |
| Möbelstadt Sommerlad | September 9, 2021 | ransomware_live | — |
| Agile Property Holdings | September 9, 2021 | ransomware_live | — |
| angstrom automotive group | September 9, 2021 | ransomware_live | — |
| Iaffaldano, Shaw & Young LLP | September 9, 2021 | ransomware_live | — |
| ENPOL LLC | September 9, 2021 | ransomware_live | — |
| CEC Vibration Products | September 9, 2021 | ransomware_live | — |
| Betenbough Homes | September 9, 2021 | ransomware_live | — |
| Allen, Dyer, Doppelt, & Gilchrist, P.A. | September 9, 2021 | ransomware_live | — |
| Apex America | September 9, 2021 | ransomware_live | — |
| Kaseya clients | July 2, 2021 | ransomware_live | — |
| University Medical Center | June 28, 2021 | ransomware_live | — |
| Fujifilm | June 1, 2021 | ransomware_live | — |
| JBS (meat processor) | May 30, 2021 | ransomware_live | — |
| Sol Oriens | May 1, 2021 | ransomware_live | — |
| Brazil's Tribunal de Justiça do Estado do Rio Grande do Sul | April 28, 2021 | ransomware_live | — |
| Apple MacBook via supplier Quanta Computer | April 20, 2021 | ransomware_live | — |
| Asteelflash | April 1, 2021 | ransomware_live | — |
| Pierre Fabre | March 31, 2021 | ransomware_live | — |
| Acer | March 1, 2021 | ransomware_live | — |
| Gyrodata Incorporated | February 21, 2021 | ransomware_live | — |
| Standley Systems (vendor to Healthcare Sector) | February 1, 2021 | ransomware_live | — |
| Dairy Farm Group | January 14, 2021 | ransomware_live | — |
| Transform Hospital Group LTD | December 1, 2020 | ransomware_live | — |
| Managed[.]com (Web Hosting Provider for Columbus County, NC, Griffin Hospital in CT, Arizona Judicial Branch, and Jackson County, OR, among others) | November 16, 2020 | ransomware_live | — |
| Beacon Health Solutions | October 1, 2020 | ransomware_live | — |
| Banco Estado (Public Bank) | September 7, 2020 | ransomware_live | — |
| Haberdashers’ Monmouth Schools | September 1, 2020 | ransomware_live | — |
| Ma Labs | August 24, 2020 | ransomware_live | — |
| Brown-Forman Corp (alcohol manufacturer) | August 1, 2020 | ransomware_live | — |
| Valley Health Systems | August 1, 2020 | ransomware_live | — |
| National Western Life (insurance) | August 1, 2020 | ransomware_live | — |
| Telecom Argentina | July 18, 2020 | ransomware_live | — |
| Cooke County Sheriff's Office | July 4, 2020 | ransomware_live | — |
| Actuaries and Associates (retirement specialist) | July 1, 2020 | ransomware_live | — |
| ADIF (Spanish railway manager) | July 1, 2020 | ransomware_live | — |
| AAA Ambulance Service | July 1, 2020 | ransomware_live | — |
| Lion (Beverage giant) | June 9, 2020 | ransomware_live | — |
| ZEGG Hotels & Store | June 1, 2020 | ransomware_live | — |
| Crozer-Keystone Health System (Delaware County, PA) | June 1, 2020 | ransomware_live | — |
| Goodman Mintz LLP | June 1, 2020 | ransomware_live | — |
| Symbiotic LLC | June 1, 2020 | ransomware_live | — |
| Telkom | May 29, 2020 | ransomware_live | — |
| Sri Lanka Telecom | May 23, 2020 | ransomware_live | — |
| Insport (sports store) | May 16, 2020 | ransomware_live | — |
| Elexon | May 14, 2020 | ransomware_live | — |
| Harvest Food Distributors (San Diego) | May 3, 2020 | ransomware_live | — |
| Sherwood Food Distributors (Detroit) | May 3, 2020 | ransomware_live | — |
| National Association of Eating Disorders | April 1, 2020 | ransomware_live | — |
| SeaChange International (supplier of video delivery software) | April 1, 2020 | ransomware_live | — |
| Town of Jupiter | March 21, 2020 | ransomware_live | — |
| 10x Genomics | March 13, 2020 | ransomware_live | — |
| Geidi (IT serves) | March 1, 2020 | ransomware_live | — |
| Brooks International (business management consultant) | March 1, 2020 | ransomware_live | — |
| Mountain View Los Altos Union High School District | January 29, 2020 | ransomware_live | — |
| Gedia Automotive Group | January 27, 2020 | ransomware_live | — |
| Tillamook County | January 22, 2020 | ransomware_live | — |
| Artech Information Systems | January 5, 2020 | ransomware_live | — |
| Travelex | December 31, 2019 | ransomware_live | — |
| LogicalNet (MSP) Schenectady, NY | December 25, 2019 | ransomware_live | — |
| Synoptek | December 24, 2019 | ransomware_live | — |
| CyrusOne | December 5, 2019 | ransomware_live | — |
| Englewood Complete Technology Services | November 25, 2019 | ransomware_live | — |
| Alphabroder | October 14, 2019 | ransomware_live | — |
| Percsoft and the Digital Dental Record | August 26, 2019 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).