stormous
First seen March 22, 2022Active188 claimed victims
The claims below are reproduced as posted by stormous on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Stormous is an Arabic-speaking, pro-Russian ransomware and hacktivist group active since at least 2022, known for politically motivated attacks across 15+ countries, collaborating with GhostSec on the GhostLocker 2.0 RaaS platform and inheriting GhostSec's RaaS operations in mid-2024. On 1st July 2026 the group has annonced the end of their operations & ervices
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Official Statement: Protecting palatineschool.org Infrastructure | June 28, 2026 | ransomware_live | — |
| monoprix.tn | June 28, 2026 | ransomware_live | — |
| eshacloudqa.com | June 28, 2026 | ransomware_live | — |
| eogb.co.uk | June 28, 2026 | ransomware_live | — |
| HIGUCHI USA, INC | June 28, 2026 | ransomware_live | — |
| higuchi-inc.co.jp | June 28, 2026 | ransomware_live | — |
| impulso-store.com | June 24, 2026 | ransomware_live | — |
| montechiaro-store.com | June 24, 2026 | ransomware_live | — |
| lorenzoni-store.com | June 24, 2026 | ransomware_live | — |
| maglificioliliana.com | June 24, 2026 | ransomware_live | — |
| jaggroup.com UPDATE-FULL DATA DUMP | June 20, 2026 | ransomware_live | — |
| mlit.com.my | June 12, 2026 | ransomware_live | — |
| SA2000.COM | June 4, 2026 | ransomware_live | — |
| katholiekamersfoort.nl | June 2, 2026 | ransomware_live | — |
| vspsolutions.com.au SAMPLE-FREE 20GB | May 13, 2026 | ransomware_live | — |
| ttt.vn UPDATE-FULL DATA DUMP | May 13, 2026 | ransomware_live | — |
| arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMP | May 11, 2026 | ransomware_live | — |
| ams-group.co.uk FULL DATA DUMP 33GB | May 9, 2026 | ransomware_live | — |
| ttt.vn TTT Corporation | May 5, 2026 | ransomware_live | — |
| cgcsa.co.za | May 3, 2026 | ransomware_live | — |
| FANASA.COM | May 3, 2026 | ransomware_live | — |
| or-technology.com | May 3, 2026 | ransomware_live | — |
| arc-reins.com + fidelityunited.ae | May 1, 2026 | ransomware_live | — |
| www.holidaypalace.com | December 8, 2025 | ransomware_live | — |
| www.bkcolombia.org | December 8, 2025 | ransomware_live | — |
| www.futureal.hu | December 8, 2025 | ransomware_live | — |
| www.goodmanmfg.com | December 8, 2025 | ransomware_live | — |
| ! | November 9, 2025 | ransomware_live | — |
| www.marjane.ma | November 6, 2025 | ransomware_live | — |
| www.danareksa.com | November 6, 2025 | ransomware_live | — |
| www.wilmar.co.id | November 6, 2025 | ransomware_live | — |
| www.francetravail.fr | October 27, 2025 | ransomware_live | — |
| www.americanadecolchones.com | October 27, 2025 | ransomware_live | — |
| www.visioninksltd.in | October 27, 2025 | ransomware_live | — |
| www.sincroslab.com | October 27, 2025 | ransomware_live | — |
| usbmemorydirect.com | October 27, 2025 | ransomware_live | — |
| North Country HealthCare | July 13, 2025 | ransomware_live | — |
| hy-vee.com | June 23, 2025 | ransomware_live | — |
| bulentklise.com.tr | June 14, 2025 | ransomware_live | — |
| French Gov | June 12, 2025 | ransomware_live | — |
| French Gov "PYV S" | June 12, 2025 | ransomware_live | — |
| education.gouv.fr | June 10, 2025 | ransomware_live | — |
| rinaldi.com.br | June 6, 2025 | ransomware_live | — |
| Volkswagen Group | May 31, 2025 | ransomware_live | — |
| Volkswagen | May 31, 2025 | ransomware_live | — |
| French Gov 2025 | May 23, 2025 | ransomware_live | — |
| French Government | May 23, 2025 | ransomware_live | — |
| thewatermansarms.net | May 21, 2025 | ransomware_live | — |
| nirvanahotels.com.tr | May 21, 2025 | ransomware_live | — |
| crystalhotels.com.tr | May 21, 2025 | ransomware_live | — |
| www.axxoshotels.com | May 21, 2025 | ransomware_live | — |
| www.wirebangkok.com | May 21, 2025 | ransomware_live | — |
| www.seashoremotel.com | May 21, 2025 | ransomware_live | — |
| www.atolon-parkhotel.com | May 19, 2025 | ransomware_live | — |
| www.jparkislandresort.com | May 15, 2025 | ransomware_live | — |
| www.regencyrestors.com | May 11, 2025 | ransomware_live | — |
| www.regencycountryclub.com | May 11, 2025 | ransomware_live | — |
| www.regencytorviscas.com | May 11, 2025 | ransomware_live | — |
| Wizz Air | April 30, 2025 | ransomware_live | — |
| KYC UK | March 17, 2025 | ransomware_live | — |
| enersolcr.com | March 14, 2025 | ransomware_live | — |
| cmr24.by | February 8, 2025 | ransomware_live | — |
| turbomp.com | February 2, 2025 | ransomware_live | — |
| biodimed.com | December 10, 2024 | ransomware_live | — |
| uatf.edu.bo | November 16, 2024 | ransomware_live | — |
| guardianhc.com | November 3, 2024 | ransomware_live | — |
| Transak.com | October 31, 2024 | ransomware_live | — |
| fractal.id | October 16, 2024 | ransomware_live | — |
| Ascires | October 14, 2024 | ransomware_live | — |
| AOSense | October 14, 2024 | ransomware_live | — |
| Ascires Biomedical Group | October 11, 2024 | ransomware_live | — |
| NASA/AOSense | October 5, 2024 | ransomware_live | — |
| aosense.com | October 5, 2024 | ransomware_live | — |
| lyra.officegroup.it | October 3, 2024 | ransomware_live | — |
| asobostudio | September 30, 2024 | ransomware_live | — |
| mivideo.club | September 13, 2024 | ransomware_live | — |
| jatelindo | September 11, 2024 | ransomware_live | — |
| acuity.co.uk | September 5, 2024 | ransomware_live | — |
| TELECO | August 17, 2024 | ransomware_live | — |
| intrama-bg | July 28, 2024 | ransomware_live | — |
| HITC.VN | June 30, 2024 | ransomware_live | — |
| Barid soft | May 10, 2024 | ransomware_live | — |
| kidx | May 2, 2024 | ransomware_live | — |
| Bayanat | May 2, 2024 | ransomware_live | — |
| fanr.gov.ae | May 2, 2024 | ransomware_live | — |
| tdra | May 2, 2024 | ransomware_live | — |
| sharik | May 2, 2024 | ransomware_live | — |
| casio india | April 5, 2024 | ransomware_live | — |
| paginesi | March 17, 2024 | ransomware_live | — |
| mioa.gov | March 14, 2024 | ransomware_live | — |
| education.eeb-lost | March 14, 2024 | ransomware_live | — |
| lostlb | March 14, 2024 | ransomware_live | — |
| duvel | March 7, 2024 | ransomware_live | — |
| viadirectamarketing | March 6, 2024 | ransomware_live | — |
| www.loghmanpharma.com | March 6, 2024 | ransomware_live | — |
| airbogo | March 5, 2024 | ransomware_live | — |
| everplast | March 4, 2024 | ransomware_live | — |
| dismogas | March 4, 2024 | ransomware_live | — |
| delia.pl | February 16, 2024 | ransomware_live | — |
| bombaygrills | February 15, 2024 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).