Close Menu

EGREGOR · Threat actor profile

THREAT ACTOR

EGREGOR_

Active

EGREGOR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of EGREGOR, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

0 Victims tracked
1 / 2 Active mirrors
— First listing
— Most recent

Leak site mirrors

2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

  • egregoranrmzapcv.onion snapshot · 2025-07-08 18:06
  • egregornews.com Welcome page snapshot · 2026-09-23 05:17

CONFIRMED ATTACKS

Egregor confirmed attacks: 92 verified incidents

Ransomnews has verified 92 Egregor incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2020 to February 2021. United States accounts for 34 of them (37%), with victims recorded in 19 countries in total. The most affected sector is manufacturing, at 21 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 6; the outcome is unrecorded in the remaining 86. Where a figure was disclosed (8 cases), these incidents account for 124,405 exposed records.

92Verified incidents
19Countries
2020–2021Active range
0%Paid, where outcome known

Confirmed victims by year

  • 202090
  • 20212

Most affected sectors

  • Manufacturing21
  • Retail13
  • Construction9
  • Service9
  • Technology9
  • Healthcare6
  • Finance5
  • Food and Beverage5

Most affected countries

  • United States34
  • France21
  • Italy5
  • Germany5
  • United Kingdom4
  • Canada4
  • Netherlands2
  • Australia2

Verified Egregor incidents

DateOrganisationSector LocationRecordsRansom paidSource
February 2021 La Pâtisserie Wach de Sélestat Food and Beverage Bas-Rhin, France — No Source
January 2021 DSC Logistics Transportation Illinois, United States — Unknown Source
December 2020 TransLink Government Vancouver, Canada 38,958 No Source
December 2020 Kmart Retail Illinois, United States — Unknown Source
December 2020 Greater Baltimore Medical Center (GBMC) HealthCare Healthcare Maryland, United States — Unknown Source
December 2020 Randstad NV Service Amsterdam, Netherlands — Unknown Source
December 2020 Epicor Technology Texas, United States — Unknown Source
December 2020 Exclusive Networks Technology Boulogne-Billancourt, France — Unknown Source
December 2020 CCCA-BTP Education Paris, France — Unknown Source
December 2020 Nav Jeevan Co-operative Bank Finance Ulhasnagar, India — Unknown Source
December 2020 Adecco Service Zürich, Switzerland — Unknown Source
December 2020 Altamaha Federal Credit Union Finance Georgia, United States — Unknown Source
November 2020 Spring Independent School District Education Texas, United States — Unknown Source
November 2020 Wipotec Group Technology Kaiserslautern, Germany — Unknown Source
November 2020 Veracel Celulose Manufacturing Eunápolis, Brazil — Unknown Source
November 2020 Unidas Retail São Paulo, Brazil — Unknown Source
November 2020 Pizon & Cie Construction Montluçon, France — Unknown Source
November 2020 Oviance Utilities Cournon d’Auvergne, France — Unknown Source
November 2020 Ouest France Other Rennes, France — Unknown Source
November 2020 OTEXIO Manufacturing Vaulx-en-Velin, France — Unknown Source
November 2020 OHST Medizintechnik AG Healthcare Rathenow, Germany — Unknown Source
November 2020 Newrest Group Food and Beverage Toulouse, France — Unknown Source
November 2020 New Zealand Bloom Retail Auckland, New Zealand — No Source
November 2020 Mayr-Melnhof Holz Holding AG Manufacturing Vienna, Austria — Unknown Source
November 2020 Maison Ty Breiz Construction Auray, France — Unknown Source
November 2020 Living Realty, Inc. Service Markham, Canada — Unknown Source
November 2020 IOC Print Service Vitry-sur-Seine, France — Unknown Source
November 2020 IFI Peinture Education Aquitaine, France — Unknown Source
November 2020 Headlam Retail Birmingham, United Kingdom — Unknown Source
November 2020 Hanon Systems Manufacturing Daejeon, South Korea — Unknown Source
November 2020 Groupe Mondial Frigo Manufacturing Saint-Priest, France — Unknown Source
November 2020 Delta Dental Plans Association Healthcare Illinois, United States — Unknown Source
November 2020 Filmatic Industrie SAS Manufacturing Grandvillars, France — Unknown Source
November 2020 Équipements Marquis, Inc. Construction Sherbrooke, Canada — No Source
November 2020 Edinburgh Woollen Mill Retail Carlisle, United Kingdom — No Source
November 2020 Degomme Boccard Manufacturing Vaulx-en-Velin, France — Unknown Source
November 2020 Central Equity Construction Melbourne, Australia — Unknown Source
November 2020 Cencosud Retail Las Condes, Chile — Unknown Source
November 2020 Tolsma-Grisnich Manufacturing Emmeloord, Netherlands — Unknown Source
November 2020 Beroki Construction Anglet, France — Unknown Source
November 2020 Apofruit Italia Retail Cesena, Italy — Unknown Source
November 2020 Coldwater Orthodontics Healthcare Michigan, United States — Unknown Source
November 2020 Alliance Automation Manufacturing Ohio, United States — Unknown Source
October 2020 Berkshire Hathaway Travel Protection Finance Wisconsin, United States 476 Unknown Source
October 2020 Rockingham Insurance (Rockingham Mutual) Finance Virginia, United States 52,564 Unknown Source
October 2020 Stromberg Metal Works, Inc. Construction Maryland, United States — Unknown Source
October 2020 Smoky Mountain Machining, Inc. Manufacturing North Carolina, United States — Unknown Source
October 2020 Quebe Holdings, Inc. Construction Ohio, United States 4,302 Unknown Source
October 2020 Verimatrix Technology Meyreuil, France — Unknown Source
October 2020 Veolog Transportation Bussy-Lettrée, France — Unknown Source
October 2020 Ubisoft Technology Montreuil, France — Unknown Source
October 2020 PanaPesca Food and Beverage Massachusetts, United States — Unknown Source
October 2020 Terrepadane Retail Piacenza, Italy — Unknown Source
October 2020 NHK International Corporation Manufacturing Michigan, United States — Unknown Source
October 2020 Netfast Technology Solutions, Inc. Technology New York, United States — Unknown Source
October 2020 National Auto Care Company Service Ohio, United States — Unknown Source
October 2020 Minerals Technologies Inc. Technology New York, United States 7,915 Unknown Source
October 2020 Louis Berger (now part of WSP) Service New Jersey, United States — Unknown Source
October 2020 Moctezuma Medjool Gardens Food and Beverage Sonora, Mexico — Unknown Source
October 2020 LCL Navigation, Ltd. Transportation Mississauga, Canada — Unknown Source
October 2020 HellermannTyton Manufacturing Manchester, United Kingdom — Unknown Source
October 2020 Double E Company Manufacturing Massachusetts, United States — Unknown Source
October 2020 Diamond C Trailer (RoadClipper Enterprises) Manufacturing Texas, United States — Unknown Source
October 2020 Foxtons Group Service London, United Kingdom — Unknown Source
October 2020 Flower Power Garden Centres Pty, Ltd. Retail Sydney, Australia — Unknown Source
October 2020 Eros Group Service Delhi, India — Unknown Source
October 2020 EMCO Manufacturing Hallein, Austria — Unknown Source
October 2020 CSEA (Cassa per i servizi energetici e ambientali) Utilities Rome, Italy — Unknown Source
October 2020 Crytek Technology Frankfurt, Germany — Unknown Source
October 2020 Carraro Group Manufacturing Campodarsego, Italy — Unknown Source
October 2020 Berzelius Stolberg GmbH Manufacturing Stolberg, Germany — Unknown Source
October 2020 Altus NZ Ltd Manufacturing Auckland, New Zealand — No Source
October 2020 ADEKA Polymer Additives Europe Manufacturing Mulhouse, France — Unknown Source
October 2020 ClearPath Security LLC Technology Colorado, United States — Unknown Source
October 2020 Centext Legal Services Legal California, United States — Unknown Source
October 2020 Carson-Dellosa Publishing LLC Other North Carolina, United States — Unknown Source
October 2020 Barnes & Noble Retail New York, United States — Unknown Source
October 2020 ASM Global (Mercedes-Benz Superdome, the Smoothie King Center, and Metairie) Other Louisiana, United States — Unknown Source
October 2020 Arbor Contract Carpet, Inc Retail Texas, United States — Unknown Source
September 2020 American European Insurance Group, Inc. (AEIG) Finance New Jersey, United States 16,414 Unknown Source
September 2020 Tighe & Bond Service Massachusetts, United States 1,031 Unknown Source
September 2020 Talon Commercial Services Construction Oklahoma, United States — Unknown Source
September 2020 Villafrut Food and Beverage Oppeano, Italy — Unknown Source
September 2020 Tekken Corporation Construction Tokyo, Japan — Unknown Source
September 2020 OPTIMA Packaging Group GmbH Manufacturing Schwäbisch Hall, Germany — Unknown Source
September 2020 Granite Gear LLC Retail Illinois, United States — Unknown Source
September 2020 Lacoste Dactyl Bureau & École Retail Le Thor, France — Unknown Source
September 2020 Dyras Dental Healthcare Michigan, United States 2,745 Unknown Source
September 2020 Gefco Logistics Transportation Puteaux, France — Unknown Source
September 2020 Dr. Soliman Fakeeh Hospital Healthcare Jeddah, Saudi Arabia — Unknown Source
September 2020 Diana Shipping Transportation Athens, Greece — Unknown Source
September 2020 APSM Systems Manufacturing Arizona, United States — Unknown Source

Claimed vs confirmed. The figures above the fold on this page come from Egregor's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.