THREAT ACTOR
CHAOS_
ActiveCHAOS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CHAOS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
92
Victims tracked
1 / 12
Active mirrors
2025-03-31
First listing
2026-09-17
Most recent
Victims by year
- 2026 61
- 2025 31
Leak site mirrors
12 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onionCHAOS snapshot · 2026-09-23 05:21 -
httj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onionIndex of / snapshot · 2025-07-02 04:14 -
2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onionIndex of / snapshot · 2025-07-02 04:14 -
k6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.onionIndex of / snapshot · 2025-06-09 16:02 -
qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onionIndex of /goosehead/ snapshot · 2026-09-22 10:23 -
cdgi6zjox6zr5epk7k5rg673qduxy7dlkk7ws3n4vusspr5bmhx24aqd.onionCHAOS snapshot · 2026-06-16 08:11 -
bna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onionIndex of / snapshot · 2025-07-02 04:01 -
een55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onionIndex of / snapshot · 2025-07-02 05:02 -
s2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onionsnapshot · 2025-09-30 22:33 -
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onionsnapshot · 2026-09-23 00:00 -
qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion403 Forbidden snapshot · 2026-09-22 10:14 -
myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion403 Forbidden snapshot · 2026-09-22 07:10
Recent victims
The 50 most recent victims claimed by CHAOS. Total in the index: 92.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-17 | expresspros.com | Express Employment Professionals — Data Breach Notification & Public D… |
| 2026-09-14 | glasfloss.com | DATA LEAK NOTICE: GLASFLOSS (glasfloss.com) A comprehensive data brea… |
| 2026-09-14 | steelhausinc.com | Steelhaus boldly drives the market with innovative energy solutions; f… |
| 2026-09-10 | mankatoclinic.com | The Mankato Clinic was founded Mankato, Minnesota in 1916, by five are… |
| 2026-09-10 | artiflexmfg.com | ArtiFlex Manufacturing LLC operates as a specialized contract manufact… |
| 2026-09-09 | copeplastics.com | Cope Plastics is a leading U.S. distributor and fabricator of performa… |
| 2026-09-06 | evergenbio.com | Evergen is a leading Contract Development and Manufacturing Organizati… |
| 2026-08-28 | corematerials.com | Core Materials (corematerials.com) — Countdown to Publication Managem… |
| 2026-08-28 | macallister.com | MacAllister (macallister.com) — Countdown to Publication Management a… |
| 2026-08-27 | singleton.com | Founded in 1986, Singleton Reynolds is a law firm. They are headquarte… |
| 2026-08-25 | parkderochie.com | Park de Rochie (parkderochie.com) – Countdown to Publication Manageme… |
| 2026-08-25 | mswalker.com | MS Walker (mswalker.com) – Countdown to Publication Management at MS … |
| 2026-08-25 | copcp.com | Central Ohio Primary Care (copcp.com) – Countdown to Publication Mana… |
| 2026-08-05 | tomorrowsoffice.com | URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office … |
| 2026-08-05 | healthcarehighways.com | WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcar… |
| 2026-07-28 | thecranewaregroup.com | Craneware’s Public Deception: The Reality Behind the 'Non-Sensitive' D… |
| 2026-07-27 | vit-best.com | DATA BREACH NOTICE: VIT-BEST.COM Status: The first 3% of the tota… |
| 2026-07-26 | remco.ca | Founded in 1977 and headquartered in Quebec, Canada, Remco is an indus… |
| 2026-07-22 | neopharmlabs.com | Notice of Data Escalation: 3% Proof Publication Management is ignorin… |
| 2026-07-22 | issvc.com | issvc.com Official Notice to Management and Stakeholders The time wi… |
| 2026-07-22 | argonautms.com | Target Organization: argonautms.com (Argonaut Manufacturing Services) … |
| 2026-07-20 | wikoff.com | [PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Dat… |
| 2026-07-16 | radiax.com | NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that w… |
| 2026-07-14 | sleemanbreweries.ca | Sleeman Breweries was founded in 1851 and headquartered in Guelph, Ont… |
| 2026-07-14 | spectrumchemical.com | Public Notice: Final Ultimatum to Spectrum Chemical Management To the… |
| 2026-07-14 | aphenapharma.com | Aphena Pharma Solutions We have gained full access to your corporate … |
| 2026-07-08 | corepharma.com | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are o… |
| 2026-07-08 | opportune.com | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are o… |
| 2026-07-06 | gisy.com | Target: Gisy.com Status: Data Exfiltration Confirmed Volume: 1.1 TB (3… |
| 2026-07-06 | aircreebec.ca | Air Creebec, founded in 1982, is a regional airline company based Wask… |
| 2026-06-30 | universalplant.com | FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of … |
| 2026-06-26 | ingerman.com | Ingerman is a developer, builder and manager of multifamily housing co… |
| 2026-06-25 | roofdepot.com | Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a r… |
| 2026-06-23 | randa.net | Randa Apparel & Accessories is a global powerhouse and one of the worl… |
| 2026-06-22 | graymont.com | NOTICE: Graymont – Final Warning We have successfully gained full acc… |
| 2026-06-09 | airespring.com | Founded in 2001, AireSpring is a Managed Services Provider specializin… |
| 2026-05-28 | entransinternational.com | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Entrans… |
| 2026-05-28 | powerhousenow.com | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Powerho… |
| 2026-05-27 | sterlingindustries.com | STERLING INDUSTRIES: FINAL NOTICE BEFORE FULL RELEASE STATUS: PENDING… |
| 2026-05-17 | wtitransport.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-17 | cstindustries.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-17 | fallprotect.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-17 | challenge-mfg.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-04 | vacaero.com | If the company's management does not reach an agreement with us within… |
| 2026-05-04 | www.cswindustrials.com | If the company's management does not contact us within 24 hours, we wi… |
| 2026-04-28 | cadencepetroleum.com | Company management has 48 hours to reach an agreement with us. If no a… |
| 2026-04-22 | alexandergroup.com | The company is disregarding its customers' data. If a deal is not reac… |
| 2026-04-20 | polycorp.com | If the company does not contact us within 48 hours, the files will be … |
| 2026-04-14 | coastappliances.com | It offers refrigerators, freezers, wall ovens, washers, and electric r… |
| 2026-04-14 | itc-group.com | Founded in 1983, ITC Construction Group is a Commercial and Residentia… |
CONFIRMED ATTACKS
Chaos confirmed attacks: 27 verified incidents
Ransomnews has verified 27 Chaos incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2025 to September 2026. United States accounts for 22 of them (81%), with victims recorded in 4 countries in total. The most affected sector is service, at 12 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 0; the outcome is unrecorded in the remaining 26. Where a figure was disclosed (15 cases), these incidents account for 257,766 exposed records.
27Verified incidents
4Countries
2025–2026Active range
100%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Chaos incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | Mankato Clinic Ltd. | Healthcare | Minnesota, United States | — | Unknown | Source |
| July 2026 | The Craneware Group | Healthcare | Edinburgh, United Kingdom | — | Unknown | Source |
| June 2026 | Opportune LLP | Service | Texas, United States | 32,552 | Unknown | Source |
| June 2026 | Wikoff Color Corporation | Manufacturing | South Carolina, United States | — | Unknown | Source |
| June 2026 | Universal Plant Services, LLC | Service | Texas, United States | — | Unknown | Source |
| June 2026 | Sleeman Breweries Ltd. | Food and Beverage | Guelph, Canada | — | Unknown | Source |
| May 2026 | Powerhouse Retail Services, LLC | Service | Texas, United States | — | Unknown | Source |
| May 2026 | Challenge Mfg. Company, LLC | Manufacturing | Michigan, United States | 24,211 | Unknown | Source |
| May 2026 | Boyd Bros. Transportation, LLC and WTI Transport, LLC | Transportation | Alabama, United States | 4,223 | Unknown | Source |
| March 2026 | KDM Signs (KDM POP Solutions Group) | Service | Ohio, United States | 1,403 | Unknown | Source |
| February 2026 | Miles Partnership, LLLP | Service | Florida, United States | — | Unknown | Source |
| February 2026 | Northern Technologies International Corporation | Manufacturing | Minnesota, United States | — | Unknown | Source |
| February 2026 | Loop Capital | Finance | Illinois, United States | 505 | Unknown | Source |
| February 2026 | NELSON Worldwide, LLC | Service | Minnesota, United States | 2,942 | Unknown | Source |
| January 2026 | Horizon Media | Service | New York, United States | 100 | Unknown | Source |
| December 2025 | B2BE | Technology | Birmingham, United Kingdom | — | Unknown | Source |
| November 2025 | mToilet | Service | Warsaw, Poland | — | Unknown | Source |
| October 2025 | ICON International, Inc. | Finance | Connecticut, United States | — | Unknown | Source |
| September 2025 | Hanson Professional Services, Inc. | Service | Illinois, United States | 2,315 | Unknown | Source |
| September 2025 | Archway Marketing Services | Service | Minnesota, United States | 1,662 | Unknown | Source |
| May 2025 | The Salvation Army | Other | London, United Kingdom | — | Unknown | Source |
| May 2025 | Optima Tax Relief, LLC | Finance | California, United States | 19,732 | Unknown | Source |
| April 2025 | Barnhart Crane & Rigging Company, Inc. | Service | Tennessee, United States | 22,822 | Unknown | Source |
| March 2025 | Goosehead Insurance, Inc. | Finance | Texas, United States | 29,324 | Unknown | Source |
| March 2025 | Farmer Brothers Company | Food and Beverage | Texas, United States | 14,460 | Unknown | Source |
| March 2025 | IES Communications, LLC | Technology | Arizona, United States | 6,241 | Unknown | Source |
| February 2025 | Berkeley Research Group, LLC | Service | California, United States | 95,274 | Yes | Source |
Claimed vs confirmed. The figures above the fold on this page come from Chaos's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.