royal
First seen November 4, 2022Active211 claimed victims
The claims below are reproduced as posted by royal on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
According to Trendmicro, Royal ransomware was first observed in September 2022, and the threat actors behind it are believed to be seasoned cybercriminals who used to be part of Conti Team One.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Braintree Public Schools | July 19, 2023 | ransomware_live | — |
| Tachi-S Engineering USA | June 11, 2023 | ransomware_live | — |
| PENNCREST School District | June 9, 2023 | ransomware_live | — |
| Grange Packing Solutions | May 26, 2023 | ransomware_live | — |
| Haworth Tompkins | May 26, 2023 | ransomware_live | — |
| Colrich | May 26, 2023 | ransomware_live | — |
| Volt | May 26, 2023 | ransomware_live | — |
| AFG Holdings | May 26, 2023 | ransomware_live | — |
| Mitutoyo | May 26, 2023 | ransomware_live | — |
| The Best Connection | May 26, 2023 | ransomware_live | — |
| DirectViz Solutions | May 26, 2023 | ransomware_live | — |
| BM Precision | May 26, 2023 | ransomware_live | — |
| Groupe Sovitrat Interim and Recrutement | May 26, 2023 | ransomware_live | — |
| Dotcom Distribution | May 23, 2023 | ransomware_live | — |
| Coos Bay | May 23, 2023 | ransomware_live | — |
| Utah-Yamas Controls | May 22, 2023 | ransomware_live | — |
| Morris Hospital | May 22, 2023 | ransomware_live | — |
| Atlas Commodities | May 22, 2023 | ransomware_live | — |
| Agostini Insurance Brokers | May 22, 2023 | ransomware_live | — |
| Trinity Exploration and Production | May 22, 2023 | ransomware_live | — |
| TA Supply | May 22, 2023 | ransomware_live | — |
| Westside | May 22, 2023 | ransomware_live | — |
| City of Dallas | May 19, 2023 | ransomware_live | — |
| NASHUA SCHOOL DISTRICT | May 18, 2023 | ransomware_live | — |
| Parker Drilling | May 15, 2023 | ransomware_live | — |
| ZBW News | May 3, 2023 | ransomware_live | — |
| Southern West Virginia Community and Technical College | May 3, 2023 | ransomware_live | — |
| Midwest Truck | May 1, 2023 | ransomware_live | — |
| Montana State University | April 29, 2023 | ransomware_live | — |
| Great Falls College of Technology | April 29, 2023 | ransomware_live | — |
| EdisonLearning | April 26, 2023 | ransomware_live | — |
| GKS Hydraulik | April 21, 2023 | ransomware_live | — |
| Encompass Group | April 21, 2023 | ransomware_live | — |
| Clarke County Hospital | April 20, 2023 | ransomware_live | — |
| MW Components | April 18, 2023 | ransomware_live | — |
| Lake Dallas Independent School District | April 18, 2023 | ransomware_live | — |
| City of Ballwin | April 14, 2023 | ransomware_live | — |
| Moon Capital | April 13, 2023 | ransomware_live | — |
| Swanson Group | April 13, 2023 | ransomware_live | — |
| Dataram | April 12, 2023 | ransomware_live | — |
| Talon Outdoor | April 12, 2023 | ransomware_live | — |
| Tom Duffy Company | April 10, 2023 | ransomware_live | — |
| Big Ass Fans | April 10, 2023 | ransomware_live | — |
| Alvaria | April 10, 2023 | ransomware_live | — |
| Nature Path Foods | April 10, 2023 | ransomware_live | — |
| Stanley Electric U.S. | April 10, 2023 | ransomware_live | — |
| Kretek International | April 5, 2023 | ransomware_live | — |
| Beghelli USA | April 3, 2023 | ransomware_live | — |
| Meade Tractor | April 1, 2023 | ransomware_live | — |
| Armstrong Watson | March 31, 2023 | ransomware_live | — |
| Benning Construction | March 30, 2023 | ransomware_live | — |
| Vending Group | March 30, 2023 | ransomware_live | — |
| Steve Silver furniture | March 30, 2023 | ransomware_live | — |
| Toho Tenax America | March 30, 2023 | ransomware_live | — |
| 5Design | March 30, 2023 | ransomware_live | — |
| Sunstar Americas | March 30, 2023 | ransomware_live | — |
| Corizon Healthcare | March 30, 2023 | ransomware_live | — |
| einhaus-gruppe | March 30, 2023 | ransomware_live | — |
| Ville de Lille | March 27, 2023 | ransomware_live | — |
| MERS Missouri Goodwill Industries | March 27, 2023 | ransomware_live | — |
| The Ultra-met | March 27, 2023 | ransomware_live | — |
| Savanna Technical College | March 27, 2023 | ransomware_live | — |
| Helmholtz Zentrum Munchen | March 27, 2023 | ransomware_live | — |
| Wymondham College | March 27, 2023 | ransomware_live | — |
| Yaskawa Motoman | March 21, 2023 | ransomware_live | — |
| Graceworks Lutheran Services | March 21, 2023 | ransomware_live | — |
| Sutton and Jacobs | March 18, 2023 | ransomware_live | — |
| AAA Energy Service | March 17, 2023 | ransomware_live | — |
| DGM Industrie | March 17, 2023 | ransomware_live | — |
| Liberty Lines | March 15, 2023 | ransomware_live | — |
| Little Mountain Residential Care and Housing Society | March 10, 2023 | ransomware_live | — |
| Materialogic | March 10, 2023 | ransomware_live | — |
| Hard Manufacturing | March 10, 2023 | ransomware_live | — |
| Jackson Dean Construction | March 10, 2023 | ransomware_live | — |
| Gottschol Alcuilux | March 10, 2023 | ransomware_live | — |
| KMVP | March 10, 2023 | ransomware_live | — |
| Highway Equipment | March 10, 2023 | ransomware_live | — |
| Thomaston Mills | March 9, 2023 | ransomware_live | — |
| Brauerei Schimpf | March 9, 2023 | ransomware_live | — |
| Wellington Power Corporation | March 9, 2023 | ransomware_live | — |
| Mainstream Engineering | March 9, 2023 | ransomware_live | — |
| PROTEKTOR | March 6, 2023 | ransomware_live | — |
| Wilhelm | March 6, 2023 | ransomware_live | — |
| Krinos Foods | March 6, 2023 | ransomware_live | — |
| Richard Sanders | March 6, 2023 | ransomware_live | — |
| The WorkPlace | March 4, 2023 | ransomware_live | — |
| FIMM | March 2, 2023 | ransomware_live | — |
| Ferretería EPA | March 2, 2023 | ransomware_live | — |
| Schwartz Hautmont Port Shop | February 24, 2023 | ransomware_live | — |
| Stone and Electrical Contractors | February 22, 2023 | ransomware_live | — |
| Ancora - Sistemas de Fixacao | February 20, 2023 | ransomware_live | — |
| DALLAS SCHOOL DISTRICT | February 20, 2023 | ransomware_live | — |
| UNIS | February 20, 2023 | ransomware_live | — |
| Evans Consoles | February 16, 2023 | ransomware_live | — |
| Delallo | February 14, 2023 | ransomware_live | — |
| Reventics | February 13, 2023 | ransomware_live | — |
| Alexandercity | February 12, 2023 | ransomware_live | — |
| Tucson Unified School District | February 10, 2023 | ransomware_live | — |
| Trendsetter Engineering | February 8, 2023 | ransomware_live | — |
| INNOVATION COLLABORATION SYNERGY | February 6, 2023 | ransomware_live | — |
Page 1 of 3Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).