RansomHouse
Data as of August 16, 2026.
Credential exposure before the attack
18.3% of RansomHouse victims whose domain we can identify (45 of 246) had employee credentials leak in the 12 months before RansomHouse named them as a victim.
We don't know whether any of these credentials were how RansomHouse gained initial access.
What industries RansomHouse targets
Sector identified for 138 of 246 victims.
| Manufacturing | 31 | |
| Healthcare | 28 | |
| Financial Services | 19 | |
| Construction | 14 | |
| Education | 9 | |
| Technology | 8 | |
| Logistics | 6 | |
| Energy | 6 |
Where the victims are located
Country identified for 118 of 246 victims.
| United States | 20 | |
| Italy | 16 | |
| United Kingdom | 9 | |
| China | 7 | |
| Spain | 6 | |
| Japan | 5 | |
| South Africa | 4 | |
| Indonesia | 4 |
Most recent RansomHouse victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Alya Construtora alyaconstrutora.com | Construction | Brazil | Aug 7, 2026 |
| City of Beacon beaconny.gov | Government | United States | Aug 7, 2026 |
| City of McMinnville mcminnvilleoregon.gov | Government | United States | Aug 7, 2026 |
| TechVentures Bank techventures.bank | Financial Services | Romania | Aug 7, 2026 |
| PCL pclholding.com | Healthcare | Thailand | Aug 4, 2026 |
| Nichirei nichirei.co.jp | Manufacturing | Japan | Jul 22, 2026 |
| Megawork megawork.com.br | Technology | Brazil | Jul 17, 2026 |
| Fidelity Services Group fidelity-services.com | Not identified | South Africa | Jul 16, 2026 |
| Bonacio bonacio.com | Construction | United States | Jun 30, 2026 |
| Prince George County princegeorgecountyva.gov | Government | United States | Jun 18, 2026 |
| Promepla promepla.com | Manufacturing | Spain | Jun 17, 2026 |
| Aegle Aviation aegleaviation.com | Not identified | India | Jun 9, 2026 |
| Ma Pak Leung mapakleung.com | Healthcare | China | Jun 9, 2026 |
| Trellix trellix.com | Technology | United States | May 8, 2026 |
| Karl Chevrolet karlchevrolet.com | Automotive | United States | Apr 30, 2026 |
| Star Energy starenergy.co.id | Energy | Indonesia | Apr 28, 2026 |
| Star Energy Geothermal starenergygeothermal.co.id | Energy | Indonesia | Apr 27, 2026 |
| Zenergy zenergy.cn | Manufacturing | China | Apr 22, 2026 |
| Winnitex winnitex.com | Manufacturing | China | Apr 20, 2026 |
| Transaction Packing transactionpacking.com | Logistics | United States | Apr 14, 2026 |
Showing the 20 most recent of 246. Browse recent data breaches for more.
RansomHouse leak sites
Addresses we've seen RansomHouse publish victims from. Any .onion address needs the Tor Browser.
dj7ww4rxmvy5vsqxqn557p3nzjmt64q4fg57tteono6ezzm3nsmhgpad.onionatpimkcvvlvyizwazff6r5ioq6nnb7txijdwvlq4i6d5b7adx6c5egyd.onionmc2pt7cfb4p3xojzsmyzt2pe7chobgkbddpdqxdscks6ttbki77xl2id.onionzohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onionvxpudlncob2ouf6pnic5khdwdb3j52ersb636c4xm3s2p2wxg6vyi4yd.onion5aidibsmc4wt5l3lw4k5wtfqopbckllb3pntw7xw4qiem4a3eeacrlyd.onion7yrwf73tckb4mtt2kms4qc7nr7rzghu3jdzycm4w4qq2nwrybi7hq7ad.onioncxkk2csneiefspqrv75vw5766sw56t67tluuekk6mm2k4f7vagh7qbyd.onionomdcwhef4ztuwhdiv3dbcgz2iyh2yb3gkkbusgvegbyjcacctahpxryd.onionuvl645c47e5bozdzrrtjtm6pea5oltef63tsewz5ucmubvsj5i7meiid.onionxw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onionzabhu2tvl3elihuccjzl4n35m27smgyxc5zkbgz3rcewjn6tjt2ihiad.onionuv4sykhrapb2t3mnhw6imkbdym4fh6vstwcdsvbtzrvdwzcd5zzlylqd.onion57yqe2tksgsmmwaqrxf45uaqy45t3hxu3dcnywjdks6lhtfztkpx57yd.oniongfkngfw25qwhd2sn43x7cflcehk3bb7v2uifjndr2sc3k2abhqs22rad.onionbiurt7anlhkncf2t3dvvtlszpnnyg3oiksyapcikxostz6zfrh4csvid.onions62ttv3adgplyinn42qetov7zrltff563qncpm67cwz73fesw7cw77yd.onionblofpgq5q3talt3y2w3y6r3focrtrk7ugmwl3e6a4pjuf5t2tivkxbqd.onionhqvcotd73c6hjfc3ogukvc37jgs2krmowyposqudq2rodtawmatxpyad.onionnw4f4x2gix7y7y3nizwj2fnf5u4tqy2mwej62r6tdqye4s5ogrtftuid.onion4dmex5fuyap32y6lkpglp5cy3ivoua452o57cezsxhfdlnhgvlw6sxid.onionjhtym7doz6dt5xdq4dd5wuhmyaa6dtesv4lrnasb5scwofguffiewcqd.onionkcikcoor63fa4qw6gx7yp2jxnvxbsxxdwd2znz72izt74rpdjfha2yqd.onionftgvamayqmlyjkpf3dosoyfafbfpxxtxagsnt45sqauulckwupr2guid.onionvopa354z4toilkjn4ileaf6rinkzn2givaokvj4yguq5kbiqoulxnzyd.onion
RansomHouse questions
Is RansomHouse still active?
Yes. RansomHouse posted its most recent victim on August 14, 2026. That's 7 victims in the last 30 days.
How many victims has RansomHouse claimed?
RansomHouse has named 246 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 65 of them were posted in the last 12 months.
When did RansomHouse first appear?
The first victim we recorded for RansomHouse was posted on February 7, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RansomHouse target?
Manufacturing accounts for the most victims we can classify, with 31. Healthcare follows at 28. We could identify a sector for 138 of 246 victims, so treat this as the shape of the targeting rather than a full census.
Has RansomHouse already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.