RansomEXX
Data as of August 16, 2026.
Credential exposure before the attack
55.4% of RansomEXX victims whose domain we can identify (41 of 74) had employee credentials leak in the 12 months before RansomEXX named them as a victim.
We don't know whether any of these credentials were how RansomEXX gained initial access.
What industries RansomEXX targets
Sector identified for 21 of 74 victims.
| Technology | 4 | |
| Construction | 3 | |
| Hospitality | 2 | |
| Healthcare | 2 | |
| Manufacturing | 2 | |
| Agriculture | 2 | |
| Government | 2 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 28 of 74 victims.
| Italy | 6 | |
| United Kingdom | 3 | |
| Brazil | 3 | |
| Japan | 2 | |
| Australia | 2 | |
| France | 2 | |
| Portugal | 1 | |
| Germany | 1 |
Most recent RansomEXX victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Go2Joy go2joy.vn | Hospitality | Vietnam | Jun 22, 2026 |
| Sogo Auction sogocorporation.com | Construction | Japan | Apr 20, 2026 |
| GoTip gotip.jp | Hospitality | Japan | Apr 17, 2026 |
| ADDA adda.io | Technology | Not identified | Mar 10, 2025 |
| Lakeshore Title lstitle.com | Financial Services | Not identified | Feb 10, 2025 |
| Makesworth Accountants makesworth.co.uk | Not identified | United Kingdom | Feb 10, 2025 |
| Grupo Vargas grupovargas.com | Manufacturing | Not identified | Jan 2, 2025 |
| Retemex retemex.com | Not identified | Not identified | Sep 16, 2024 |
| Brontoo Technology Solutions brontoo.com | Technology | India | Aug 12, 2024 |
| NURSING.com nursing.com | Healthcare | Not identified | Aug 5, 2024 |
| Planet Group International planetgroupint.com | Technology | Not identified | Jul 29, 2024 |
| Liteon liteon.com | Not identified | Not identified | Jul 29, 2024 |
| Wagner-Meinert wagner-meinert.com | Construction | Not identified | Jul 16, 2024 |
| TUV Rheinland tuv.com | Not identified | Not identified | Jul 2, 2024 |
| Asteco Property Management asteco.com | Real Estate | United Arab Emirates | Apr 18, 2024 |
| Jacobs Farm del Cabo jacobsfarmdelcabo.com | Agriculture | Not identified | Mar 27, 2024 |
| Ministry of Defense of Peru mindef.gob.pe | Government | Peru | Mar 27, 2024 |
| AlJaber jec.qa | Construction | Not identified | Nov 27, 2023 |
| admilia.fr | Technology | France | Nov 16, 2023 |
| Telecommunications Services of Trinidad and Tobago tstt.co.tt | Government | Not identified | Oct 29, 2023 |
Showing the 20 most recent of 74. Browse recent data breaches for more.
RansomEXX leak sites
Addresses we've seen RansomEXX publish victims from. Any .onion address needs the Tor Browser.
zubllg7o774lgc4rdxmfcfpjewfkqa7ml7gxwl5fetogc7hbkvaprhid.onionrbx2hfyej6sogivjtw2z2xkcqwgtiy653ap5jylggsrj6glbmfr7axqd.onionrnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion
RansomEXX questions
Is RansomEXX still active?
Yes. RansomEXX posted its most recent victim on June 22, 2026.
How many victims has RansomEXX claimed?
RansomEXX has named 74 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 3 of them were posted in the last 12 months.
When did RansomEXX first appear?
The first victim we recorded for RansomEXX was posted on November 30, 2020. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RansomEXX target?
Technology accounts for the most victims we can classify, with 4. Construction follows at 3. We could identify a sector for 21 of 74 victims, so treat this as the shape of the targeting rather than a full census.
Has RansomEXX already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.