termite
First seen November 17, 2024Active61 claimed victims
The claims below are reproduced as posted by termite on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Termite is a ransomware group first identified in late 2024 using a modified version of Babuk ransomware code; its most notable attack was the November 2024 breach of supply-chain software firm Blue Yonder, claiming 680 GB of exfiltrated data and disrupting major customers including Starbucks.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| iDentalSoft | October 9, 2026 | ransomware_live | — |
| https://www.identalsoft.com/ | October 9, 2026 | ransomlook | — |
| https://www.aon.com/ | October 7, 2026 | ransomlook | — |
| Aon | October 6, 2026 | ransomware_live | — |
| https://www.crossettinc.com/ | September 26, 2026 | ransomlook | — |
| Crossett | September 25, 2026 | ransomware_live | — |
| theLender | September 22, 2026 | ransomware_live | — |
| TruAmerica Multifamily | September 22, 2026 | ransomware_live | — |
| Sealcon | September 22, 2026 | ransomware_live | — |
| https://www.sealconusa.com/ | September 22, 2026 | ransomlook | — |
| https://thelender.com/ | September 22, 2026 | ransomlook | — |
| https://www.truamerica.com/ | September 22, 2026 | ransomlook | — |
| Everglades Boats | August 13, 2026 | ransomware_live | — |
| Affinia Healthcare | July 28, 2026 | ransomware_live | — |
| JD Young | July 27, 2026 | ransomware_live | — |
| Roland Machinery | June 8, 2026 | ransomware_live | — |
| Cal Fresh | June 8, 2026 | ransomware_live | — |
| Wiese USA | June 5, 2026 | ransomware_live | — |
| UEI College | May 29, 2026 | ransomware_live | — |
| Indiana Mills and Manufacturing | May 29, 2026 | ransomware_live | — |
| RAMAR FOODS INTERNATIONAL | May 12, 2026 | ransomware_live | — |
| Millennium Dental Technologies | April 16, 2026 | ransomware_live | — |
| Noll and Tam Architects | March 16, 2026 | ransomware_live | — |
| City of Huntington | March 6, 2026 | ransomware_live | — |
| Bartram Trail Surveying | March 3, 2026 | ransomware_live | — |
| Birmingham Museum of Art | February 24, 2026 | ransomware_live | — |
| The Siskiyou Telephone | February 24, 2026 | ransomware_live | — |
| Jones Haber | February 24, 2026 | ransomware_live | — |
| Family Health Center | February 2, 2026 | ransomware_live | — |
| MedHelp | December 17, 2025 | ransomware_live | — |
| News-Press and Gazette Co. | September 29, 2025 | ransomware_live | — |
| News-Press & Gazette Co. | September 26, 2025 | ransomware_live | — |
| News-Press & Gazette Co. | September 26, 2025 | ransomware_live | — |
| News-Press & Gazette Co. | September 26, 2025 | ransomware_live | — |
| News-Press & Gazette Co. | September 16, 2025 | ransomware_live | — |
| Insight Hospital & Medical Center Chicago | September 2, 2025 | ransomware_live | — |
| Insight Hospital and Medical Center Chicago | September 2, 2025 | ransomware_live | — |
| LGM | April 29, 2025 | ransomware_live | — |
| Ushio | April 28, 2025 | ransomware_live | — |
| Bjørklund | April 11, 2025 | ransomware_live | — |
| On IT | April 10, 2025 | ransomware_live | — |
| Perrigo Company | March 14, 2025 | ransomware_live | — |
| Genea | February 24, 2025 | ransomware_live | — |
| Ligentia | February 19, 2025 | ransomware_live | — |
| Arcandco | February 19, 2025 | ransomware_live | — |
| Rooks Rider Solicitors | February 19, 2025 | ransomware_live | — |
| National Legal Service | February 19, 2025 | ransomware_live | — |
| London Belgravia | February 19, 2025 | ransomware_live | — |
| CESI | February 11, 2025 | ransomware_live | — |
| Zschimmer and Schwarz | January 30, 2025 | ransomware_live | — |
| Huntington Hotel Group | January 9, 2025 | ransomware_live | — |
| Tharisa | December 17, 2024 | ransomware_live | — |
| Blue Yonder | December 6, 2024 | ransomware_live | — |
| Watsonville Community Hospital | December 5, 2024 | ransomware_live | — |
| Conseil scolaire Viamonde | November 14, 2024 | ransomware_live | — |
| Département de La Réunion | November 14, 2024 | ransomware_live | — |
| Lebenshilfe Heinsberg | November 13, 2024 | ransomware_live | — |
| Nifast | November 12, 2024 | ransomware_live | — |
| Oman Oil | November 12, 2024 | ransomware_live | — |
| Culligan | April 26, 2024 | ransomware_live | — |
| Hermes Medical Solutions | May 11, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).