RansomwareBlog
Data as of August 16, 2026.
Credential exposure before the attack
21.9% of RansomwareBlog victims whose domain we can identify (7 of 32) had employee credentials leak in the 12 months before RansomwareBlog named them as a victim.
We don't know whether any of these credentials were how RansomwareBlog gained initial access.
What industries RansomwareBlog targets
Sector identified for 23 of 32 victims.
| Manufacturing | 6 | |
| Financial Services | 3 | |
| Education | 2 | |
| Healthcare | 2 | |
| Construction | 2 | |
| Hospitality | 2 | |
| Telecommunications | 2 | |
| Logistics | 1 |
Where the victims are located
Country identified for 17 of 32 victims.
| Canada | 3 | |
| United Kingdom | 2 | |
| United States | 2 | |
| Netherlands | 2 | |
| France | 1 | |
| Switzerland | 1 | |
| Hungary | 1 | |
| Germany | 1 |
Most recent RansomwareBlog victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Kelsey School Division kelseyschooldivision.ca | Education | Canada | Dec 30, 2025 |
| Powerscourt powerscourt.com | Not identified | United Kingdom | Dec 30, 2025 |
| Rene Industries rene.co.ug | Healthcare | Not identified | Dec 30, 2025 |
| Teknequip teknequip.com | Manufacturing | United Kingdom | Dec 30, 2025 |
| Voltech Rebuilders voltechrebuilders.com | Manufacturing | Canada | Dec 30, 2025 |
| Dulay & Dulay dulay.ca | Financial Services | Canada | Nov 18, 2025 |
| US Energy usenergy.com | Energy | United States | Sep 15, 2025 |
| Mulia Raya muliaraya.co.id | Not identified | Indonesia | May 30, 2025 |
| Unigaz unigaz.net | Not identified | Not identified | May 30, 2025 |
| Curtain Bluff curtainbluff.com | Hospitality | Not identified | Mar 26, 2025 |
| Clínica Meta clinicameta.co | Healthcare | Colombia | Mar 3, 2025 |
| Micro Manufacturing micromfg.com | Manufacturing | Not identified | Feb 13, 2025 |
| Bendix Engineering bendixengineering.com | Not identified | Not identified | Jan 9, 2025 |
| Geocell geocell.ge | Telecommunications | Not identified | Nov 27, 2024 |
| Silknet silknet.com | Telecommunications | Not identified | Nov 27, 2024 |
| Skalar skalar.com | Manufacturing | Netherlands | Mar 26, 2024 |
| skalar.com | Manufacturing | Netherlands | Dec 6, 2023 |
| Ada-Borup-West School District k12.mn.us | Education | United States | Oct 24, 2023 |
| wellons.org | Financial Services | Not identified | Oct 24, 2023 |
| Insulcana insulcana.com | Construction | Not identified | Jul 28, 2023 |
Showing the 20 most recent of 32. Browse recent data breaches for more.
RansomwareBlog leak site
The address we've seen RansomwareBlog publish victims from. Any .onion address needs the Tor Browser.
z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion
RansomwareBlog questions
Is RansomwareBlog still active?
It's gone quiet. The last victim we recorded was December 30, 2025, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has RansomwareBlog claimed?
RansomwareBlog has named 32 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 7 of them were posted in the last 12 months.
When did RansomwareBlog first appear?
The first victim we recorded for RansomwareBlog was posted on April 19, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does RansomwareBlog target?
Manufacturing accounts for the most victims we can classify, with 6. Financial Services follows at 3. We could identify a sector for 23 of 32 victims, so treat this as the shape of the targeting rather than a full census.
Has RansomwareBlog already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.