spacebears
First seen April 29, 2024Active160 claimed victims
The claims below are reproduced as posted by spacebears on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Space Bears is a double-extortion ransomware group that emerged in April 2024, distinguished by a professional "corporate" aesthetic on its leak site, leveraging Phobos RaaS infrastructure and targeting small-to-medium organizations in manufacturing, technology, and healthcare across the US and Europe.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| L&S Mechanical | March 18, 2025 | ransomware_live | — |
| Whittaker & Company | March 2, 2025 | ransomware_live | — |
| South Georgia Accounting Services | February 23, 2025 | ransomware_live | — |
| Pineland community service board | February 3, 2025 | ransomware_live | — |
| CAMRIDGEPORT | February 1, 2025 | ransomware_live | — |
| Metro Wire & Cable | January 26, 2025 | ransomware_live | — |
| Arrow Motor Auctions | January 24, 2025 | ransomware_live | — |
| PINELAND BHDD COMMUNITY SERVICES | January 23, 2025 | ransomware_live | — |
| SANTA MARIA LABORATORIO | January 22, 2025 | ransomware_live | — |
| Christian Community Aid | January 22, 2025 | ransomware_live | — |
| Bethany Hospital | January 21, 2025 | ransomware_live | — |
| Inaya Clinique | January 21, 2025 | ransomware_live | — |
| Sharm Reef Hotel | January 14, 2025 | ransomware_live | — |
| Fukoku Co. Ltd. | January 9, 2025 | ransomware_live | — |
| General Digital CRM | January 8, 2025 | ransomware_live | — |
| General Digital | January 8, 2025 | ransomware_live | — |
| EBL PARTNERS (construction|interiors), Florida | January 8, 2025 | ransomware_live | — |
| SmithDunn&Co | December 31, 2024 | ransomware_live | — |
| Atos (Business Services · France) | December 24, 2024 | ransomware_live | — |
| JRT Automatisation | December 19, 2024 | ransomware_live | — |
| CNHW Landscape Design, Ltd | November 25, 2024 | ransomware_live | — |
| Namforce Life Insurance | November 21, 2024 | ransomware_live | — |
| Aptus Value Housing Finance India Ltd | November 20, 2024 | ransomware_live | — |
| MENZIES CNAC (Jardine Aviation Services, Agility) | November 8, 2024 | ransomware_live | — |
| Aptus | November 5, 2024 | ransomware_live | — |
| MENZIES CNAC (Jardine Aviation Services) | October 31, 2024 | ransomware_live | — |
| Intermed Hospital Mongolia | October 30, 2024 | ransomware_live | — |
| Precision Steel Services | October 21, 2024 | ransomware_live | — |
| Codival | August 20, 2024 | ransomware_live | — |
| Kemlon Products & Development Co Inc | August 1, 2024 | ransomware_live | — |
| EBL PARTNERS (construction interiors), Florida | July 30, 2024 | ransomware_live | — |
| Gemicar | July 29, 2024 | ransomware_live | — |
| CNPS Cameroun | July 29, 2024 | ransomware_live | — |
| Stienemann | July 24, 2024 | ransomware_live | — |
| EFRON LAW FIRM | July 21, 2024 | ransomware_live | — |
| Keystone Engineering | July 20, 2024 | ransomware_live | — |
| Un Museau | July 4, 2024 | ransomware_live | — |
| Haylem | July 3, 2024 | ransomware_live | — |
| ARISTA | July 2, 2024 | ransomware_live | — |
| Gokals Consumer Electronics & Computers Retail · Fiji | June 18, 2024 | ransomware_live | — |
| Sun City Pediatrics PA (USA, TX) | June 12, 2024 | ransomware_live | — |
| Lee Trevino Dental (USA,TX) | June 11, 2024 | ransomware_live | — |
| SAWA INTERNATIONAL | June 4, 2024 | ransomware_live | — |
| Hytera US Inc | May 25, 2024 | ransomware_live | — |
| GIANNI CUCUINI | May 20, 2024 | ransomware_live | — |
| Mesopolys | May 17, 2024 | ransomware_live | — |
| BLADE | May 16, 2024 | ransomware_live | — |
| Heli Securite | May 13, 2024 | ransomware_live | — |
| InVogue Women Healthcare, PLLC (USA,TX) | May 10, 2024 | ransomware_live | — |
| Lexibar | May 7, 2024 | ransomware_live | — |
| Rotor Team | May 6, 2024 | ransomware_live | — |
| Seoyon E-Hwa | April 29, 2024 | ransomware_live | — |
| todoagro | April 28, 2024 | ransomware_live | — |
| CORTEX Chiropractic & Clinical Neuroscience | April 28, 2024 | ransomware_live | — |
| Fliesenstudio am Rhein | April 27, 2024 | ransomware_live | — |
| Fifisystems | April 27, 2024 | ransomware_live | — |
| Mr Bean | April 26, 2024 | ransomware_live | — |
| Thinkadam | April 26, 2024 | ransomware_live | — |
| Surewerx USA | April 25, 2024 | ransomware_live | — |
| SM EMBALLAGE | April 25, 2024 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).