← security

Ransomware Victims

topic · security/ransomware-victims
DOC.
security/ransomware-victims
REV.
1,057 evt
DATE.
08-JUN-2026
SCOPE.
custom
§01

about

Newly claimed ransomware victims posted to leak sites, by group (ransomware.live).

§02

recent events

LIVElast event 0s ago2 evt / 1h

showing 10 of 979 events in this window (1,057 total on topic). adjust the range or clear it with ALL.

range
iso 8601 utc
iso 8601 utc
01haugbuersten.de — safepaysafepay claimed haugbuersten.de (DE){"url":"http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/bl…
EVENT. cms3lyrbID. cms3lyrbb9w5xkh0cx5fmq28sSRC. key:cmpxakb6…
{
  "url": "http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/haugbuerstende/",
  "group": "safepay",
  "sector": "Retail & E-Commerce",
  "source": "ransomware.live",
  "victim": "haugbuersten.de",
  "country": "DE",
  "attack_date": "2026-07-27T19:01:39.495Z",
  "published_at": "2026-07-27T19:01:55.408Z",
  "discovered_at": "2026-07-27T19:01:55.408Z",
  "victim_website": null
}
02paritaet-nrw.org — safepaysafepay claimed paritaet-nrw.org (DE){"url":"http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/bl…
EVENT. cms3lyqrID. cms3lyqrm9w5vkh0c5xi0o49zSRC. key:cmpxakb6…
{
  "url": "http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/paritaet-nrworg/",
  "group": "safepay",
  "sector": "Professional Services",
  "source": "ransomware.live",
  "victim": "paritaet-nrw.org",
  "country": "DE",
  "attack_date": "2026-07-27T19:02:15.059Z",
  "published_at": "2026-07-27T19:02:30.124Z",
  "discovered_at": "2026-07-27T19:02:30.124Z",
  "victim_website": null
}
03moebelmayer.de — safepaysafepay claimed moebelmayer.de (DE){"url":"http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/bl…
EVENT. cms3lyq7ID. cms3lyq7k9w5tkh0c7ce4hepxSRC. key:cmpxakb6…
{
  "url": "http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/moebelmayerde/",
  "group": "safepay",
  "sector": "Retail & E-Commerce",
  "source": "ransomware.live",
  "victim": "moebelmayer.de",
  "country": "DE",
  "attack_date": "2026-07-27T19:02:48.890Z",
  "published_at": "2026-07-27T19:03:04.369Z",
  "discovered_at": "2026-07-27T19:03:04.369Z",
  "victim_website": null
}
04zinorm.de — safepaysafepay claimed zinorm.de (DE){"url":"http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/bl…
EVENT. cms3lypnID. cms3lypnd9w5rkh0chmdk7mf8SRC. key:cmpxakb6…
{
  "url": "http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/zinormde/",
  "group": "safepay",
  "sector": "Not Found",
  "source": "ransomware.live",
  "victim": "zinorm.de",
  "country": "DE",
  "attack_date": "2026-07-27T19:03:23.310Z",
  "published_at": "2026-07-27T19:03:39.007Z",
  "discovered_at": "2026-07-27T19:03:39.007Z",
  "victim_website": null
}
05Ernst & Young — shinyhuntersshinyhunters claimed Ernst & Young (US){"url":"","group":"shinyhunters","sector":"Professional Services","source":"rans…
EVENT. cms396ggID. cms396ggs9sw5kh0ckv3mltm3SRC. key:cmpxakb6…
{
  "url": "",
  "group": "shinyhunters",
  "sector": "Professional Services",
  "source": "ransomware.live",
  "victim": "Ernst & Young",
  "country": "US",
  "attack_date": "2026-07-27T11:10:00.000Z",
  "published_at": "2026-07-27T12:58:56.004Z",
  "discovered_at": "2026-07-27T12:58:56.004Z",
  "victim_website": null
}
06RingCentral, Inc. — shinyhuntersshinyhunters claimed RingCentral, Inc. (US){"url":"","group":"shinyhunters","sector":"Technology","source":"ransomware.live…
EVENT. cms396fwID. cms396fw09sw3kh0cs4oypkdmSRC. key:cmpxakb6…
{
  "url": "",
  "group": "shinyhunters",
  "sector": "Technology",
  "source": "ransomware.live",
  "victim": "RingCentral, Inc.",
  "country": "US",
  "attack_date": "2026-07-27T11:10:00.000Z",
  "published_at": "2026-07-27T12:59:16.314Z",
  "discovered_at": "2026-07-27T12:59:16.314Z",
  "victim_website": null
}
07Savills France — qilinqilin claimed Savills France (FR){"url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/si…
EVENT. cms370b3ID. cms370b319s9nkh0cykyp3vfsSRC. key:cmpxakb6…
{
  "url": "http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=6435c147-970c-4b24-9f6b-3e04ac9dddad",
  "group": "qilin",
  "sector": "Professional Services",
  "source": "ransomware.live",
  "victim": "Savills France",
  "country": "FR",
  "attack_date": "2026-07-27T00:00:00.000Z",
  "published_at": "2026-07-27T11:59:02.253Z",
  "discovered_at": "2026-07-27T11:59:02.253Z",
  "victim_website": null
}
08Wilbert's — qilinqilin claimed Wilbert's (US){"url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/si…
EVENT. cms370aiID. cms370ai79s9lkh0cduwc94mySRC. key:cmpxakb6…
{
  "url": "http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=af6a747d-1fc7-42e2-a953-0c198cf49576",
  "group": "qilin",
  "sector": "Retail & E-Commerce",
  "source": "ransomware.live",
  "victim": "Wilbert's",
  "country": "US",
  "attack_date": "2026-07-27T11:58:04.234Z",
  "published_at": "2026-07-27T11:58:25.874Z",
  "discovered_at": "2026-07-27T11:58:25.874Z",
  "victim_website": null
}
09Katathani Phuket Beach Resort — dragonforcedragonforce claimed Katathani Phuket Beach Resort (TH){"url":"http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/bl…
EVENT. cms2u2qtID. cms2u2qtc9p1xkh0cbjedad51SRC. key:cmpxakb6…
{
  "url": "http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog/?post_uuid=8289671c-c761-48b7-833b-f75f83d4b7b8",
  "group": "dragonforce",
  "sector": "Hospitality",
  "source": "ransomware.live",
  "victim": "Katathani Phuket Beach Resort",
  "country": "TH",
  "attack_date": "2026-07-27T04:22:45.848Z",
  "published_at": "2026-07-27T05:22:38.980Z",
  "discovered_at": "2026-07-27T05:22:38.980Z",
  "victim_website": null
}
10Tesco Engineer — DeadlockDeadlock claimed Tesco Engineer (GB){"url":"","group":"Deadlock","sector":"Retail & E-Commerce","source":"ransomware…
EVENT. cms2rxk4ID. cms2rxk4d9ojpkh0ca8hx064vSRC. key:cmpxakb6…
{
  "url": "",
  "group": "Deadlock",
  "sector": "Retail & E-Commerce",
  "source": "ransomware.live",
  "victim": "Tesco Engineer",
  "country": "GB",
  "attack_date": "2026-07-27T04:20:17.286Z",
  "published_at": "2026-07-27T04:20:18.909Z",
  "discovered_at": "2026-07-27T04:20:18.909Z",
  "victim_website": null
}
showing 1–10 of 979older →
§03

subscribe

three pathways carry every event on this topic. pick the one that fits your agent.

GETrss feed
any reader · no auth
https://api.callsign.sh/v1/public/channels/security/topics/ransomware-victims/feed.xml
GETjson pull
poll on your schedule · optional since/until
https://api.callsign.sh/v1/public/channels/security/topics/ransomware-victims.json
POSTwebhook
push delivery · one POST per event
log in to subscribe →
→ feed.xml→ json pull
subscribe by reader, by pull loop, or by webhook above