RansomHouse

Active

248 victims named on the leak site

2 in the last 30 days

63 in the last 12 months

Feb 2022 first victim we recorded

Sep 11, 2026 most recent victim posted

25 leak sites tracked

Data as of September 14, 2026.

Credential exposure before the attack

18.1% of RansomHouse victims whose domain we can identify (45 of 248) had employee credentials leak in the 12 months before RansomHouse named them as a victim.

We don't know whether any of these credentials were how RansomHouse gained initial access.

What industries RansomHouse targets

Sector identified for 140 of 248 victims.

Manufacturing	31
Healthcare	28
Financial Services	19
Construction	14
Education	10
Technology	8
Government	6
Energy	6

Where the victims are located

Country identified for 121 of 248 victims.

United States	21
Italy	16
United Kingdom	9
China	7
Spain	6
Japan	6
Indonesia	4
Belgium	4

Most recent RansomHouse victims

Victim	Sector	Country	Posted
California School Employees Association csea.com	Education	United States	Sep 11, 2026
REXT rext.jp	Retail	Japan	Sep 2, 2026
Alya Construtora alyaconstrutora.com	Construction	Brazil	Aug 7, 2026
City of Beacon beaconny.gov	Government	United States	Aug 7, 2026
City of McMinnville mcminnvilleoregon.gov	Government	United States	Aug 7, 2026
TechVentures Bank techventures.bank	Financial Services	Romania	Aug 7, 2026
PCL pclholding.com	Healthcare	Thailand	Aug 4, 2026
Nichirei nichirei.co.jp	Manufacturing	Japan	Jul 22, 2026
Megawork megawork.com.br	Technology	Brazil	Jul 17, 2026
Fidelity Services Group fidelity-services.com	Not identified	South Africa	Jul 16, 2026
Bonacio bonacio.com	Construction	United States	Jun 30, 2026
Prince George County princegeorgecountyva.gov	Government	United States	Jun 18, 2026
Promepla promepla.com	Manufacturing	Spain	Jun 17, 2026
Aegle Aviation aegleaviation.com	Not identified	India	Jun 9, 2026
Ma Pak Leung mapakleung.com	Healthcare	China	Jun 9, 2026
Trellix trellix.com	Technology	United States	May 8, 2026
Karl Chevrolet karlchevrolet.com	Automotive	United States	Apr 30, 2026
Star Energy starenergy.co.id	Energy	Indonesia	Apr 28, 2026
Star Energy Geothermal starenergygeothermal.co.id	Energy	Indonesia	Apr 27, 2026
Zenergy zenergy.cn	Manufacturing	China	Apr 22, 2026

Showing the 20 most recent of 248. Browse recent data breaches for more.

RansomHouse leak sites

Addresses we've seen RansomHouse publish victims from. Any .onion address needs the Tor Browser.

dj7ww4rxmvy5vsqxqn557p3nzjmt64q4fg57tteono6ezzm3nsmhgpad.onion
atpimkcvvlvyizwazff6r5ioq6nnb7txijdwvlq4i6d5b7adx6c5egyd.onion
mc2pt7cfb4p3xojzsmyzt2pe7chobgkbddpdqxdscks6ttbki77xl2id.onion
zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion
vxpudlncob2ouf6pnic5khdwdb3j52ersb636c4xm3s2p2wxg6vyi4yd.onion
5aidibsmc4wt5l3lw4k5wtfqopbckllb3pntw7xw4qiem4a3eeacrlyd.onion
7yrwf73tckb4mtt2kms4qc7nr7rzghu3jdzycm4w4qq2nwrybi7hq7ad.onion
cxkk2csneiefspqrv75vw5766sw56t67tluuekk6mm2k4f7vagh7qbyd.onion
omdcwhef4ztuwhdiv3dbcgz2iyh2yb3gkkbusgvegbyjcacctahpxryd.onion
uvl645c47e5bozdzrrtjtm6pea5oltef63tsewz5ucmubvsj5i7meiid.onion
xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion
zabhu2tvl3elihuccjzl4n35m27smgyxc5zkbgz3rcewjn6tjt2ihiad.onion
uv4sykhrapb2t3mnhw6imkbdym4fh6vstwcdsvbtzrvdwzcd5zzlylqd.onion
57yqe2tksgsmmwaqrxf45uaqy45t3hxu3dcnywjdks6lhtfztkpx57yd.onion
gfkngfw25qwhd2sn43x7cflcehk3bb7v2uifjndr2sc3k2abhqs22rad.onion
biurt7anlhkncf2t3dvvtlszpnnyg3oiksyapcikxostz6zfrh4csvid.onion
s62ttv3adgplyinn42qetov7zrltff563qncpm67cwz73fesw7cw77yd.onion
blofpgq5q3talt3y2w3y6r3focrtrk7ugmwl3e6a4pjuf5t2tivkxbqd.onion
jhtym7doz6dt5xdq4dd5wuhmyaa6dtesv4lrnasb5scwofguffiewcqd.onion
4dmex5fuyap32y6lkpglp5cy3ivoua452o57cezsxhfdlnhgvlw6sxid.onion
nw4f4x2gix7y7y3nizwj2fnf5u4tqy2mwej62r6tdqye4s5ogrtftuid.onion
hqvcotd73c6hjfc3ogukvc37jgs2krmowyposqudq2rodtawmatxpyad.onion
kcikcoor63fa4qw6gx7yp2jxnvxbsxxdwd2znz72izt74rpdjfha2yqd.onion
4s2org6ns4uhmamkr2tshq6f6auusktjjdoo23rskwhxfdlxlnx5rnyd.onion
scuj56wenkc4oltbf35mxjqprwpyw7hfy4pwfwb54nfjs2ukemfodnyd.onion

RansomHouse questions

Is RansomHouse still active?

Yes. RansomHouse posted its most recent victim on September 11, 2026. That's 2 victims in the last 30 days.

How many victims has RansomHouse claimed?

RansomHouse has named 248 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 63 of them were posted in the last 12 months.

When did RansomHouse first appear?

The first victim we recorded for RansomHouse was posted on February 7, 2022. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does RansomHouse target?

Manufacturing accounts for the most victims we can classify, with 31. Healthcare follows at 28. We could identify a sector for 140 of 248 victims, so treat this as the shape of the targeting rather than a full census.

Has RansomHouse already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.