THREAT ACTOR
EMBARGO_
ActiveEMBARGO is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of EMBARGO, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
44
Victims tracked
9 / 55
Active mirrors
2024-04-21
First listing
2026-09-10
Most recent
Victims by year
- 2026 11
- 2025 16
- 2024 17
Leak site mirrors
55 mirrors tracked, 9 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onionEMBARGO snapshot · 2026-09-23 03:36 -
5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onionEMBARGO snapshot · 2024-06-29 09:03 -
76yl7gfmz2kkjglcevxps4tleyeqnqhfcxh6rnstxj27oxhoxird3hyd.onionsnapshot · 2024-10-03 02:08 -
yj3eozlkkxkcsprc2fug7tolgtnllruyavuyyar3yzsccjdgvu2bl2yd.onionIndex of / snapshot · 2025-08-03 18:10 -
ufjoe7fdwvml52oin7flwlqksvp3fcvfyh2kwsngt7j2yf7xou52w2qd.onionIndex of / snapshot · 2025-08-03 18:14 -
i2okedfryhllg6ka6aur3wnxcxdaufbuuysp4drr5xoc6gvqpcogejid.onionIndex of / snapshot · 2025-08-03 18:13 -
s37weqmxusvfcxkoorgkut5v7frn27zftdb6pdjsyjl5djg6oxjqjbid.onionIndex of / snapshot · 2025-08-03 18:07 -
oftm4u5cfl6wyadj27h3csdxfvyd7favssxcr7l7wnswdsrfedxswxqd.onionIndex of / snapshot · 2025-08-03 18:13 -
wg55rcy2chmbpeh6pl5pftnveac2lqfxbletrtzanfjhhmvcjnn5tcqd.onionIndex of / snapshot · 2026-08-08 12:05 -
sbjthwyoxfuxq75b77e2hsj7ie67m3qicfnuikhuabwo3sikvrzyaxad.onionIndex of / snapshot · 2025-08-03 18:00 -
zo5xog4vpvdae473doneepetidh36m5czdq2vyeiq3lvqhuel56p6nid.onionIndex of / snapshot · 2025-08-03 18:00 -
66ohzao6afsv2opk22r2kv6fbnf2fthe7v4ykzzc5vjezvvyf3gocwyd.onionIndex of / snapshot · 2025-08-03 18:16 -
2nn4b6gihz5bttzabjegune3blwktad2zmy77fwutvvrxxodbufo6qid.onionApache2 Debian Default Page: It works snapshot · 2025-04-03 11:12 -
y6kyfs2unbfcyodzjrxadn4w5vyulhyotdi5dtiqulxbduujehupunqd.onionIndex of / snapshot · 2026-08-08 11:20 -
embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onionsnapshot · 2026-09-23 05:05 -
3o5ewrzhqoyodfs5kll4cjxagdfrpuu474panwobm4im7ejfpaux5jyd.onionIndex of / snapshot · 2025-08-03 18:15 -
4q5tsu5o3msmv4am4dfhupwhzlyg7wv3lpswbvbhcrknr4ega7xetxad.onionsnapshot · 2026-03-04 20:09 -
z2b75lk7xf6kme3zfvlmdmpwiaansnkcuhsojd23dgub5md24fhogcyd.onionIndex of / snapshot · 2026-07-18 20:24 -
7lxwbzlkpjyuahuvngwwkc4mycj2a4flh45ksqjo2ezfdbkmxmlxikad.onionIndex of / snapshot · 2025-04-03 11:08 -
7watkqnnuwxvlpgy5gaosgqy67nve3jgpy37xobqngmswz3vuvde56yd.onionIndex of / snapshot · 2025-08-03 18:19 -
5dw7bszmidrhpoltqbqmpixpz6mvgez3mr6xc7ktval2glrmbxkwopad.onionIndex of / snapshot · 2026-09-23 03:36 -
a3kvb22nuhfgaluy6uzufrjn3azzsu7tylszdbyne3kiextdmxz4nnyd.onionEMBARGO snapshot · 2026-09-23 05:36 -
ec6edgevw2lzqy4ipafpbvjuu7r6ugqbljqokl3pvecc6c3a5ix3wgyd.onionIndex of / snapshot · 2026-09-23 05:05 -
qrthxx5hkttfl3pk57eou6ddqi34pxsibxvndq7vt5pblqbaurkmxbqd.onionIndex of / snapshot · 2026-04-17 09:26 -
usu2gxoiijvnswhfymd6ucjjwhtgqby4c4ywzvnrtw4i6mpgppvzpsad.onionIndex of / snapshot · 2026-04-17 09:16 -
qk5nd25xdnygqrey7al2tb3xop5brk7kxua7xr2zrgftzked43bku4yd.onionIndex of / snapshot · 2026-09-23 00:00 -
p474ku5ehoex7mfsbdenppakbb4twvrnvggjzhp53xw4z5qq6glm4yad.onionIndex of / snapshot · 2026-09-23 00:00 -
vh2wkazjlflm6pvwtvw2fnztu3dcw4346lasvikzeg25yhx6bjvl5pqd.onionIndex of / snapshot · 2026-08-09 21:02 -
rngjexyyyl5mek5kg2lkxilqfef5nr6bpa4u24i5ei5hb3ydsh5drpid.onionIndex of / snapshot · 2026-04-17 09:23 -
tamvd5fdyvpekhaf2sdg5sum73ra2abc4h2iqihijpvw4hythnlmuhid.onionIndex of / snapshot · 2026-04-17 09:34
Recent victims
The 50 most recent victims claimed by EMBARGO. Total in the index: 44.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-10 | gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local | Gardens Alive, Inc. is a privately held U.S. consumer goods company sp… |
| 2026-06-30 | www.maytrucking.com | May Trucking Company is a family-owned interstate transport carrier fo… |
| 2026-06-09 | Auburn Electrical Construction Company | Auburn Electrical Construction Company, Inc. is an innovative contract… |
| 2026-04-23 | chipsoft.com | ChipSoft provides innovative software solutions for healthcare institu… |
| 2026-04-20 | cipsoft.com | Dutch healthcare software provider ChipSoft is currently responding to… |
| 2026-03-31 | https://www.lagoonpark.com/ | Lagoon Amusement Park , located in Farmington, Utah, is a historic fa… |
| 2026-03-26 | ludlums.com | Ludlum Measurements, Inc. (LMI), founded in 1962 in Sweetwater, Texas… |
| 2026-03-14 | westport.com | We connect synergistic technologies to power a cleaner tomorrow. As a … |
| 2026-03-11 | seclore.com | At Seclore, we believe that cybersecurity should revolve around what m… |
| 2026-03-11 | ubm.hu | The UBM Group is a leading Hungarian agricultural company, founded in … |
| 2026-03-09 | nch.com | Your leading global experts in industrial solutions. At NCH Corpora… |
| 2025-12-06 | lso.com | Lone Star Overnight (LSO) is headquartered in Austin, Texas, and, over… |
| 2025-11-28 | Heart of America Medical Centr (HAMC) | About Heart of America Medical Center A non-profit hospital offering … |
| 2025-11-28 | usadebusk.com | USA DeBusk provides a comprehensive suite of industrial cleaning and i… |
| 2025-11-28 | ACTi.com | ACTi Corporation, founded in 2003, is a leading application developer … |
| 2025-07-08 | rotaryeng.com.sg | DATA AVAILABLE CreatedUpdatedAvailable 6/10/2025, 6:24:58 PM6/13/202… |
| 2025-07-08 | hawaiiunified.com | DATA AVAILABLE CreatedUpdatedAvailable 6/2/2025, 6:59:58 AM6/24/2025… |
| 2025-05-30 | M&H Electric Fabricators | Welcome to M&H Electric Fabricators, where we've been sparking innovat… |
| 2025-05-26 | allstarflooring.com | All Star Flooring, Inc. is a leading provider of commercial flooring s… |
| 2025-05-14 | Kingsmen Creatives Ltd. | Kingsmen Creatives designs roll-out retail environments based off thei… |
| 2025-03-14 | rixos.com | Founded in 2000 and headquartered in Dubai, United Arab Emirates, Rixo… |
| 2025-03-09 | Insider Technologies Limited | Based in Manchester, Great Britain, Insider technologies is a leading … |
| 2025-02-25 | tequaly.com | One of Brazil's largest suppliers of technological systems, maintenanc… |
| 2025-02-17 | myhscu.com | Heritage South Credit Union was originally chartered in 1937 as the Av… |
| 2025-02-16 | annegrady.org | Anne Grady Services provides a vast array of assistance for adults and… |
| 2025-02-14 | Heritage South Credit Union | Heritage South Credit Union was originally chartered in 1937 as the Av… |
| 2025-01-09 | alansarioman.com | Al Ansari is a provider of integrated building, infrastructure and eng… |
| 2024-11-30 | backyarddiscovery.com | Backyard Discovery is built for families. From a child’s first playset… |
| 2024-11-13 | American Associated Pharmacies | American Associated Pharmacies (AAP) is a member-owned cooperative of … |
| 2024-11-05 | wexfordcounty.org | Located in Northern Lower Michigan, Wexford County boasts a population… |
| 2024-11-05 | mh-m.org | Memorial Hospital and Manor celebrated its 50th Anniversary in 2010. M… |
| 2024-11-05 | Memorial Hospital & Manor | Memorial Hospital and Manor celebrated its 50th Anniversary in 2010. M… |
| 2024-09-30 | weisermemorialhospital.org | Weiser Memorial Hospital is a full service not-for-profit community ho… |
| 2024-08-02 | pioneerworldwide.com | Founded in 1917, Pioneer Balloon Company is the world's premier manufa… |
| 2024-08-02 | summervillepolice.com | The Summerville Police Department is committed to building relationshi… |
| 2024-07-12 | diligentusa.com | Diligent Delivery Systems provides transportation services for busines… |
| 2024-07-03 | gerard-perrier.com | Gerard Perrier Industrie SA is a France-based company that provides el… |
| 2024-06-30 | jla.com | JLA are the largest provider of critical equipment and rapid-response … |
| 2024-06-06 | dmedelivers.com | Marketing, Printing, Logistics |
| 2024-05-21 | shamrocktradingcorp.com | Shamrock Trading Corporation is the parent company for a family of bra… |
| 2024-05-18 | orga-soft.de | Software Development |
| 2024-05-08 | rexmoore.com | Founded in 1922 and headquartered in Sacramento, California, Rex Moore… |
| 2024-05-01 | firstmac.com.au | Firstmac Limited is an Australian owned company with experience in hom… |
| 2024-04-21 | mulfordconstruction.com | Heavy Civil Contracting, Earthwork and Utilities |
CONFIRMED ATTACKS
Embargo confirmed attacks: 21 verified incidents
Ransomnews has verified 21 Embargo incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from January 2024 to June 2026. United States accounts for 16 of them (76%), with victims recorded in 6 countries in total. The most affected sector is manufacturing, at 6 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 2; the outcome is unrecorded in the remaining 18. Where a figure was disclosed (12 cases), these incidents account for 792,222 exposed records.
21Verified incidents
6Countries
2024–2026Active range
33%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Embargo incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2026 | May Trucking Company | Transportation | Oregon, United States | 3,766 | Unknown | Source |
| April 2026 | ChipSoft | Healthcare | Amsterdam, Netherlands | — | Unknown | Source |
| March 2026 | Westport Fuel Systems Inc. | Manufacturing | Vancouver, Canada | — | Unknown | Source |
| March 2026 | Ludlum Measurements, Inc. | Manufacturing | Texas, United States | 3,191 | Unknown | Source |
| January 2026 | NCH Corporation | Manufacturing | Texas, United States | 4,732 | Unknown | Source |
| September 2025 | USA DeBusk LLC | Service | Texas, United States | 10,585 | Unknown | Source |
| June 2025 | Heart of America Medical Center (HAMC) | Healthcare | North Dakota, United States | — | Unknown | Source |
| May 2025 | Kingsmen Creatives Ltd. | Service | Singapore, Singapore | — | Unknown | Source |
| January 2025 | Heritage South Credit Union | Finance | Alabama, United States | — | Unknown | Source |
| November 2024 | Leisure Time Products, LLC d/b/a Backyard Discovery | Manufacturing | Kansas, United States | 1,065 | Unknown | Source |
| November 2024 | Wexford County | Government | Michigan, United States | — | No | Source |
| November 2024 | Memorial Hospital & Manor | Healthcare | Georgia, United States | 120,085 | Unknown | Source |
| October 2024 | American Associated Pharmacies (AAP) | Healthcare | Alabama, United States | 8,042 | Yes | Source |
| September 2024 | Weiser Memorial Hospital | Healthcare | Idaho, United States | 59,990 | Unknown | Source |
| July 2024 | Diligent Delivery Systems | Transportation | Texas, United States | 10,545 | Unknown | Source |
| July 2024 | Pioneer Blue Balloon, LLC | Manufacturing | Kansas, United States | 491 | Unknown | Source |
| July 2024 | Town of Summerville | Government | South Carolina, United States | — | Unknown | Source |
| June 2024 | Gerard Perrier Industrie | Manufacturing | Lyon, France | — | No | Source |
| May 2024 | Shamrock Trading Corporation | Transportation | Kansas, United States | 718 | Unknown | Source |
| April 2024 | Firstmac | Finance | Brisbane, Australia | — | Unknown | Source |
| January 2024 | NorthBay HealthCare | Healthcare | California, United States | 569,012 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Embargo's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.