teamxxx
First seen June 10, 2025Active12 claimed victims
The claims below are reproduced as posted by teamxxx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
TeamXXX is an emerging ransomware group that launched its leak site in June 2025, claiming victims across healthcare, agriculture, hospitality, financial services, and shipping sectors in the US, UK, Norway, Ireland, and Europe within its first months.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Scania.com | August 3, 2025 | ransomware_live | — |
| Intercommunityct.org | July 3, 2025 | ransomware_live | — |
| Websterhenry.com | July 2, 2025 | ransomware_live | — |
| aetoscapitalasia.com | June 20, 2025 | ransomware_live | — |
| webberrestaurantgroup.com | June 1, 2025 | ransomware_live | — |
| BelkorpAg.com | April 29, 2025 | ransomware_live | — |
| ationwidecare.org | April 28, 2025 | ransomware_live | — |
| Nationwidecare.org | April 28, 2025 | ransomware_live | — |
| event-medical.com | April 22, 2025 | ransomware_live | — |
| narvikhavn.no | March 3, 2025 | ransomware_live | — |
| interiorsgroup.ie | March 1, 2025 | ransomware_live | — |
| peterpauper | February 17, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).