// THREAT ACTOR
DAIXIN_
ActiveDAIXIN is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of DAIXIN — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 3
- 2024 6
- 2023 7
- 2022 6
Leak site mirrors
11 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onionData Leak snapshot · 2026-08-19 23:08 -
232fwh5cea3ub6qguz3pynijxfzl2uj3c73nbrayipf3gq25vtq2r4qd.onionsnapshot · 2024-12-11 12:03 -
7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onionData Leak snapshot · 2026-08-20 00:02 -
htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onionsnapshot · 2025-05-23 07:20 -
kolbh6putvp6aw3vpmsppor4kyzs7ctxfbp2donetycftz5jru73ytid.onionsnapshot · 2024-12-11 12:04 -
kyk6lixosktvbtf3g6zte7kdzid2lwrprfod55mhwunafx6jzeoui7yd.onionsnapshot · 2024-12-11 12:04 -
pkx3r7xe42z7fgkjjbocf7okdh77bsvngwvp6arykksob7gleyswicyd.onionsnapshot · 2024-12-11 12:04 -
qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd.onionsnapshot · 2024-12-11 12:04 -
r3h2balq6aa7plwe5p5bhxzwzxusrtldbfaamfseg33a5hk77bohzxyd.onionsnapshot · 2024-12-11 12:04 -
v66nzl27xxmrulq6c2plrzr7tryv2idflhclpoyxrrn3kfw5gkkpveid.onionsnapshot · 2024-12-11 12:05 -
htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onionIndex of /data/gift1/ snapshot · 2025-05-23 07:05
Recent victims
The 50 most recent victims claimed by DAIXIN. Total in the index: 22.
| Date listed | Victim | Description |
|---|---|---|
| 2025-09-10 | Gagosian(US, UK) | Established by Larry Gagosian in Los Angeles in 1980, Gagosian is a gl… |
| 2025-07-02 | Insurance Office of America (US) | Insurance Office of America (IOA) is a premier, full-service insurance… |
| 2025-04-02 | A little gift of exclusive data for everyone | |
| 2024-12-03 | SGS Co (US) | Brand design and packaging solutions agency. |
| 2024-12-03 | Communicare Inc.(US) | Communicare, Inc. has been a premier provider of behavioral health ser… |
| 2024-07-22 | Acadian Ambulance (US) | Acadian Ambulance is an employee-owner private ambulance service that … |
| 2024-06-05 | Dubai Municipality (UAE) | Dubai Municipality is the Government of Dubai municipal body with juri… |
| 2024-05-21 | Regional Cancer Center (RCC) in Thiruvananthapuram ( fabrication !!) | |
| 2024-04-14 | Omni Hotels & Resorts (US) | Omni Hotels & Resorts is an American privately held, international lux… |
| 2023-12-09 | Graphic Solutions Group Inc (US) | GSG digital printing technologies with a half a century of knowledge a… |
| 2023-11-28 | North Texas Municipal Water District (US) | The North Texas Municipal Water District (NTMWD) provides vital wholes… |
| 2023-11-02 | Bluewater Health (CA) and others | Bluewater Health is a hospital in Sarnia, Ontario. The hospita… |
| 2023-06-09 | Columbus Regional Healthcare System (US) | Columbus Regional Healthcare System has one of the highest volume … |
| 2023-03-29 | Hit Promotional Products (US) | Hit Promotional Products has been a leader in the promotional product … |
| 2023-02-11 | B&G Foods (CA, US) | B&G Foods, Inc. manufactures, sells, and distributes a portfolio of sh… |
| 2023-01-20 | Guardian Analytics (US) | Guardian Analytics is now a part of NICE Actimize, a business of NICE … |
| 2022-11-24 | Astra Daihatsu Motor (ID) | PT Astra Daihatsu Motor is an automobile manufacturing company based i… |
| 2022-11-20 | AirAsia Group (MY, ID, TH) | AirAsia is a Malaysian multinational low-cost airline headquartered ne… |
| 2022-09-13 | OakBend Medical (USA) | OakBend Medical is passionately focused on patient-centered medicine. … |
| 2022-08-18 | Fitzgibbon Hospital (USA) | Fitzgibbon Hospital is a leader in central Missouri in providing quali… |
| 2022-08-18 | Trib Total Media (USA) | Trib Total Media delivers news, information and advertising to portion… |
| 2022-08-18 | ISTA International GmbH | ista International GmbH provides submetering and billing of water and … |
// CONFIRMED ATTACKS
Daixin confirmed attacks: 13 verified incidents
Ransomnews has verified 13 Daixin incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2022 to June 2025. United States accounts for 10 of them (77%), with victims recorded in 4 countries in total. The most affected sector is healthcare, at 6 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 5; the outcome is unrecorded in the remaining 8. Where a figure was disclosed (11 cases), these incidents account for 9,122,464 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Daixin incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2025 | Insurance Office of America | Finance | Florida, United States | 12,913 | Unknown | Source |
| November 2024 | Inlet Health (Communicare) | Healthcare | Kentucky, United States | 3,771 | Unknown | Source |
| June 2024 | Acadian Ambulance | Healthcare | Louisiana, United States | 2,896,985 | No | Source |
| March 2024 | Omni Hotels & Resorts | Other | Texas, United States | — | Unknown | Source |
| November 2023 | North Texas Municipal Water District | Government | Texas, United States | 1,157 | Unknown | Source |
| October 2023 | TransForm Shared Service Organization (Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, Windsor Regional Hospital) | Healthcare | Ontario, Canada | 270,198 | No | Source |
| May 2023 | Columbus Regional Healthcare System | Healthcare | North Carolina, United States | 132,887 | No | Source |
| February 2023 | B&G Foods, Inc. | Food and Beverage | New Jersey, United States | 918 | No | Source |
| January 2023 | Guardian Analytics, Inc. | Finance | California, United States | 191,563 | Unknown | Source |
| November 2022 | AirAsia Group | Transportation | Karnataka, India | 5,000,000 | Unknown | Source |
| September 2022 | OakBend Medical Center | Healthcare | Texas, United States | 500,000 | Unknown | Source |
| August 2022 | ista International | Utilities | Essen, Germany | — | Unknown | Source |
| June 2022 | Fitzgibbon Hospital | Healthcare | Missouri, United States | 112,072 | No | Source |
Claimed vs confirmed. The figures above the fold on this page come from Daixin's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.