RansomHub
Data as of August 16, 2026.
Credential exposure before the attack
46.2% of RansomHub victims whose domain we can identify (366 of 793) had employee credentials leak in the 12 months before RansomHub named them as a victim.
We don't know whether any of these credentials were how RansomHub gained initial access.
What industries RansomHub targets
Sector identified for 447 of 793 victims.
| Manufacturing | 84 | |
| Construction | 65 | |
| Healthcare | 51 | |
| Financial Services | 45 | |
| Education | 37 | |
| Technology | 32 | |
| Logistics | 19 | |
| Legal | 19 |
Where the victims are located
Country identified for 271 of 793 victims.
| Brazil | 28 | |
| Italy | 23 | |
| United Kingdom | 20 | |
| Canada | 17 | |
| United States | 16 | |
| Australia | 14 | |
| India | 13 | |
| Spain | 12 |
Most recent RansomHub victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Delta Life delta-life.com | Financial Services | Not identified | Apr 1, 2025 |
| EuropTec europtec.com | Not identified | Switzerland | Apr 1, 2025 |
| intellioan.com intellioan.com | Financial Services | Not identified | Apr 1, 2025 |
| Jackpot Junction Casino Hotel jackpotjunction.com | Hospitality | Not identified | Apr 1, 2025 |
| Assisi assisi.nl | Not identified | Netherlands | Mar 31, 2025 |
| Bassi bassi.it | Manufacturing | Italy | Mar 31, 2025 |
| PHA phakr.com | Manufacturing | United States | Mar 31, 2025 |
| Allmilmo allmilmoe.com | Not identified | Not identified | Mar 28, 2025 |
| Bratten Electric brattenelectrictn.com | Not identified | Not identified | Mar 28, 2025 |
| Conterra Networks conterra.com | Telecommunications | Not identified | Mar 27, 2025 |
| D&S Electrical Contractors dselectrical.com | Construction | Not identified | Mar 27, 2025 |
| FKM Elemente fkm-elemente.de | Manufacturing | Germany | Mar 27, 2025 |
| Hong Thong Rice hongthongrice.com | Not identified | Thailand | Mar 27, 2025 |
| AFNIGC afnigc.ca | Not identified | Canada | Mar 26, 2025 |
| Argento SC argentosc.com | Not identified | Not identified | Mar 26, 2025 |
| Carolina Air Conditioning carolinaac.com | Not identified | Not identified | Mar 26, 2025 |
| CORMIDOM cormidom.com.do | Not identified | Not identified | Mar 26, 2025 |
| Creative Logistic Services creativelogisticservices.com | Logistics | Not identified | Mar 26, 2025 |
| Garb garbinc.com | Not identified | Not identified | Mar 26, 2025 |
| Kankakee Public Library lions-online.org | Not identified | Not identified | Mar 26, 2025 |
Showing the 20 most recent of 793. Browse recent data breaches for more.
RansomHub leak sites
Addresses we've seen RansomHub publish victims from. Any .onion address needs the Tor Browser.
ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onionxeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onionfpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.oniongofile.ioransombgegc4e2vuq45noxekkmauikzt7qu6ab2rqsthdyxdpdufbqid.onionvqcrizmr7757hjbamfcb7pei2zv462o4ypi2djj4xvy5ax7f2b3c7bad.oniontotos7fquprkecvcsl2jwy72v32glgkp2ejeqlnx5ynnxvbebgnletqd.onionng2gzceugc2df6hp6s7wtg7hpupw37vqkvamaydhagv2qbrswdqlq6ad.onionufile.iotemp.shthiis.co.ukfile.ioransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onionkbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onionqizbccvwop45aeyp7bnrwo7lymltoy2umqkg626gvj7mf5wxuucch6yd.onionjg5tcesf2bwacot7fgzut2u3vhfbzj5jwmad4qqlemjojla6wpzriaqd.oniondswue36iu2jivpitivi4nt2kacmgy43rd57f3v4yfmsvtzpzefjblqqd.onionkq23rdcqs4dwg6lpfgqcguu6amhcqjwtgjrtbqx4pngynxegaeshc2yd.onion2trx4xjrakda3nxmal55jdcqnqa7l5rqvlkxmrfuzjscxnizq5zfnryd.oniontz6wd4n5yxg6ffe35icmhwfghmhv5gn7pkvj5ks7tpy6bkwpbskcebqd.onion26lmq5zpjtkqzbehxqhhpspz6gd57mj6csexomgvp5qzjjpqwq6qceyd.onionghlzmejuanuubgv3p27z6pzqfjoflynk7n423x2odoo56e6ygwqqbyqd.onionxuyeifqtcpndk3iekbqrm3svaogxel6iai7yf6oipnlz5loth4wtk7qd.onionrqdymvyrslrt54fbjnxkyynhcbylymmcl2q2ysq45hilhxxhe2ds2lyd.onionp2cip77qase7362useys4ay6f5kmu3llxh3hmadffyjrjvr5yfvnn2qd.onion
RansomHub questions
Is RansomHub still active?
Not for over a year. The last victim we recorded was April 1, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has RansomHub claimed?
RansomHub has named 793 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did RansomHub first appear?
The first victim we recorded for RansomHub was posted on April 19, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RansomHub target?
Manufacturing accounts for the most victims we can classify, with 84. Construction follows at 65. We could identify a sector for 447 of 793 victims, so treat this as the shape of the targeting rather than a full census.
Has RansomHub already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.