sinobi
First seen July 5, 2025Active274 claimed victims
The claims below are reproduced as posted by sinobi on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| L S GRIM | December 18, 2025 | ransomware_live | — |
| Ragland & Jones, LLP. | December 18, 2025 | ransomware_live | — |
| RK Centers | December 18, 2025 | ransomware_live | — |
| Heritage Engineering | December 18, 2025 | ransomware_live | — |
| Homestead Electrical Contracting | December 18, 2025 | ransomware_live | — |
| Empire Screen Printing | December 18, 2025 | ransomware_live | — |
| Florida Orthopaedic Associates | December 16, 2025 | ransomware_live | — |
| Power Curbers | December 16, 2025 | ransomware_live | — |
| Trine Access Technology | December 16, 2025 | ransomware_live | — |
| AIRCOND S.R.L. | December 16, 2025 | ransomware_live | — |
| Cinema Concepts | December 16, 2025 | ransomware_live | — |
| Mercury Wire Products | December 16, 2025 | ransomware_live | — |
| TACK Electronics | December 16, 2025 | ransomware_live | — |
| A Uzzo | December 16, 2025 | ransomware_live | — |
| Keycodes Inspection Agency | December 16, 2025 | ransomware_live | — |
| Centurion Security & Investigations | December 16, 2025 | ransomware_live | — |
| Bowman Trailer Leasing | December 16, 2025 | ransomware_live | — |
| Shlansky Law Group | December 16, 2025 | ransomware_live | — |
| Peaker Services | December 16, 2025 | ransomware_live | — |
| Milhench Supply Company | December 16, 2025 | ransomware_live | — |
| Lanmark Group | December 16, 2025 | ransomware_live | — |
| Holiday Tours | December 16, 2025 | ransomware_live | — |
| Clean Air | December 9, 2025 | ransomware_live | — |
| James Free Jewelers | December 9, 2025 | ransomware_live | — |
| CPS | December 9, 2025 | ransomware_live | — |
| Quality Companies | December 7, 2025 | ransomware_live | — |
| Galesi Group | December 7, 2025 | ransomware_live | — |
| Gopher Industrial | December 7, 2025 | ransomware_live | — |
| Jeffrey W Krol & Associates | December 7, 2025 | ransomware_live | — |
| Caldwell & Company Accounting | December 7, 2025 | ransomware_live | — |
| SLA.DK | December 7, 2025 | ransomware_live | — |
| TCG | December 7, 2025 | ransomware_live | — |
| The Landreau Group | December 7, 2025 | ransomware_live | — |
| Sterling Biotech | December 7, 2025 | ransomware_live | — |
| Delko | December 5, 2025 | ransomware_live | — |
| CCJM | December 3, 2025 | ransomware_live | — |
| Garrett Taylor, Dds | December 2, 2025 | ransomware_live | — |
| Reading Elevator Service | December 2, 2025 | ransomware_live | — |
| GV Service | December 2, 2025 | ransomware_live | — |
| Pathmaker Group | December 2, 2025 | ransomware_live | — |
| Secure Network Solutions | November 26, 2025 | ransomware_live | — |
| Homestead Museum | November 23, 2025 | ransomware_live | — |
| Liberty Gold Fruit | November 23, 2025 | ransomware_live | — |
| Access Search | November 23, 2025 | ransomware_live | — |
| Advanced Dental | November 23, 2025 | ransomware_live | — |
| StatMedPlus LLC | November 23, 2025 | ransomware_live | — |
| Rempe Construction | November 23, 2025 | ransomware_live | — |
| Adept | November 22, 2025 | ransomware_live | — |
| Erie Molded Plastics | November 20, 2025 | ransomware_live | — |
| CHANGEPOND | November 19, 2025 | ransomware_live | — |
| Croft | November 19, 2025 | ransomware_live | — |
| PATLITE | November 19, 2025 | ransomware_live | — |
| H G Reynolds | November 17, 2025 | ransomware_live | — |
| Lincoln IT | November 17, 2025 | ransomware_live | — |
| Air Design Systems | November 17, 2025 | ransomware_live | — |
| Genrose Stone + Tile | November 17, 2025 | ransomware_live | — |
| Kids & Company | November 14, 2025 | ransomware_live | — |
| Hongji Metal | November 11, 2025 | ransomware_live | — |
| CapitalPlus Exchange | November 9, 2025 | ransomware_live | — |
| Seward County, KS | November 9, 2025 | ransomware_live | — |
| Middlesex Endodontics | November 9, 2025 | ransomware_live | — |
| heywood.org | November 9, 2025 | ransomware_live | — |
| C.M.G, entreprise de serrurerie et métallerie à Saint Calais | October 30, 2025 | ransomware_live | — |
| Post Ranch Inn | October 30, 2025 | ransomware_live | — |
| TFC Poultry | October 30, 2025 | ransomware_live | — |
| WarmBlue | October 28, 2025 | ransomware_live | — |
| Florida-Spectrum Environmental Services | October 28, 2025 | ransomware_live | — |
| Crown Automotive Sales | October 28, 2025 | ransomware_live | — |
| Cavalry Consulting | October 27, 2025 | ransomware_live | — |
| Deltta + Unique data center | October 27, 2025 | ransomware_live | — |
| Luis Garratón | October 27, 2025 | ransomware_live | — |
| SanDiego Automotive Museum | October 27, 2025 | ransomware_live | — |
| glawitsch-sutter | October 27, 2025 | ransomware_live | — |
| Cohen's Fashion Optical | October 27, 2025 | ransomware_live | — |
| Crave Management | October 21, 2025 | ransomware_live | — |
| Prime Dental | October 21, 2025 | ransomware_live | — |
| SANHUA INTERNATIONAL | October 21, 2025 | ransomware_live | — |
| Phoenix Village Dental | October 20, 2025 | ransomware_live | — |
| South Atlanta Medical Clinic | October 20, 2025 | ransomware_live | — |
| MSC-Wireless | October 20, 2025 | ransomware_live | — |
| Grupo JSA | October 20, 2025 | ransomware_live | — |
| Greater Mental Health of New York | October 20, 2025 | ransomware_live | — |
| HOEHNER RESEARCH & CONSULTING GROUP | October 17, 2025 | ransomware_live | — |
| D Magazine Partners | October 17, 2025 | ransomware_live | — |
| McDonald Building | October 17, 2025 | ransomware_live | — |
| Zierick Manufacturing Corporation | October 15, 2025 | ransomware_live | — |
| East Jefferson General Hospital | October 15, 2025 | ransomware_live | — |
| Newmark Healthcare Services | October 15, 2025 | ransomware_live | — |
| Core Resources Inc (CRI) | October 15, 2025 | ransomware_live | — |
| Sunbelt Design & Development | October 12, 2025 | ransomware_live | — |
| CMF | October 12, 2025 | ransomware_live | — |
| IDB Clinicas | October 12, 2025 | ransomware_live | — |
| Sunbulah Group | October 10, 2025 | ransomware_live | — |
| Bellingham Vet Center | October 10, 2025 | ransomware_live | — |
| Paleontological Research Institution | October 10, 2025 | ransomware_live | — |
| Complete Milling Lab | October 10, 2025 | ransomware_live | — |
| Tecnomarket | October 8, 2025 | ransomware_live | — |
| Termotasajero | October 8, 2025 | ransomware_live | — |
| St Catherine of Siena | October 8, 2025 | ransomware_live | — |
| Bohlsen Restaurant Group | October 8, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).