THREAT ACTOR
GENESIS_
DormantGENESIS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of GENESIS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 91
- 2025 24
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onionGENESIS snapshot · 2026-09-17 21:05
Recent victims
The 50 most recent victims claimed by GENESIS. Total in the index: 115.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-15 | Bernath & Rosenberg | A full service CPA firm |
| 2026-09-15 | Dorfman Abrams Music, P.C | A full service CPA firm |
| 2026-08-25 | S******* | An International Public Company |
| 2026-08-23 | Hospitality Health ER (Longview) | A healthcare organization |
| 2026-08-12 | **E*** | A healthcare organization |
| 2026-08-11 | Consolidated Medical Practices of Memphis | A healthcare organization |
| 2026-08-11 | Interim HealthCare | A healthcare organization dealing with elderly care services |
| 2026-07-31 | **** | A healthcare organization |
| 2026-07-31 | Boyum IT Solutions (HOT!) | A provider of IT services |
| 2026-07-31 | C.A. Walker Construction | A construction management company |
| 2026-07-27 | Williams Accounting Professional | A full service CPA firm |
| 2026-07-27 | JJP Slip Forming Inc. | A company that operates in the Restaurants industry |
| 2026-07-27 | Building Envelope Systems | A reputable construction company based in Plainville, MA |
| 2026-07-27 | Westlake Realty Group, Inc. | A full-service real estate development company |
| 2026-07-27 | Servonix Technologies | A provider of IT services |
| 2026-07-27 | Infinity Pipeline,Inc. | A family owned, local construction company. |
| 2026-07-05 | Apex Agro, LLC | A Chemical Production Company |
| 2026-07-05 | Mirage Endoscopy Center | A healthcare organization |
| 2026-07-05 | Bri-Tech, Inc | A technology design and integration firm |
| 2026-07-05 | SBI Software | An Enterprise Resource Planning Software Provider |
| 2026-07-05 | DICON | A general contracting construction firm |
| 2026-07-05 | Westgate | A construction management company |
| 2026-07-05 | Dunagan Associates | Provides services in residential real estate and insurance |
| 2026-07-05 | Synergy Interactive | A provider of staffing services |
| 2026-07-05 | East Texas Family Medicine | A healthcare organization |
| 2026-06-30 | Brooklyn Defender Services | A legal organization dedicated to safeguard the rights of its clients |
| 2026-06-18 | United Personnel (a division of Masis Staffing Solutions) | A provider of staffing services |
| 2026-06-18 | The Associated Builders and Contractors of Indiana/Kentucky | A trade association |
| 2026-06-06 | *B* | A trade association |
| 2026-06-05 | Family Medical Associates of Raleigh | A healthcare organization |
| 2026-05-30 | Cavalier Flooring Systems Inc. | A flooring and tile contractor |
| 2026-05-30 | Wentworth | the DC Metro area's premier design-build firm |
| 2026-05-30 | Green Resource | A leading distributor of professional fertilizers, chemicals, and seed… |
| 2026-05-30 | Cedar Street Capital (A part of a Cynvestors Limited Partnership) | A private investment entity associated with Cynthia Stiehl |
| 2026-05-30 | A Roettgers | Fuel distributor and gas station operator |
| 2026-05-29 | ******** & Co | A provider of financial services |
| 2026-05-29 | *M** | A healthcare organization |
| 2026-05-28 | Peña & Bromberg | A legal firm dedicated to safeguard the rights of its clients |
| 2026-05-23 | **** & ******** | A legal firm dedicated to safeguard the rights of its clients |
| 2026-05-12 | Pequod Associates | A global leader in the provision of Marine Claims TPA and Recovery ser… |
| 2026-05-12 | Casino Gaming Commission | Official Casino Gaming Commission of Jamaica. |
| 2026-05-12 | Fargo Moorhead West Fargo Chamber | A business services provider. |
| 2026-05-12 | Integrated Process Engineers & Constructors. | Specializes in custom modular process systems, offering a wide range o… |
| 2026-05-12 | Ben F. Barcus and associates pllc | A law firm from Tacoma, WA. |
| 2026-05-12 | Palo | Architecture and Planning. |
| 2026-05-12 | HostBooks (HOT!) | An accounting software provider. |
| 2026-05-09 | CarePoint Health | CarePoint Health will provide all patients of the company's affiliated… |
| 2026-05-09 | The American Board of Preventive Medicine | A healthcare certification organization. |
| 2026-05-09 | Prescott & Holden | A legal firm dedicated to safeguard the rights of its clients |
| 2026-05-09 | Van Atta Engineering | A civil engineering and surveying firm located at 570 Congress Park Dr… |
CONFIRMED ATTACKS
Genesis confirmed attacks: 13 verified incidents
Ransomnews has verified 13 Genesis incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2025 to July 2026. United States accounts for 12 of them (92%), with victims recorded in 2 countries in total. The most affected sector is healthcare, at 8 confirmed victims. Where a figure was disclosed (3 cases), these incidents account for 615,806 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Genesis incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Hospitality Health ER (Longview) | Healthcare | Texas, United States | — | Unknown | Source |
| April 2026 | Family Medical Associates of Raleigh | Healthcare | North Carolina, United States | 500 | Unknown | Source |
| March 2026 | CarePoint Health | Healthcare | Mississauga, Canada | — | Unknown | Source |
| February 2026 | City of Hart | Government | Michigan, United States | — | Unknown | Source |
| January 2026 | National Association on Drug Abuse Programs, Inc. (NADAP) | Other | New York, United States | 90,000 | Unknown | Source |
| December 2025 | Sierra Management Group Inc. | Healthcare | California, United States | — | Unknown | Source |
| December 2025 | IMA Diligence Services, LLC | Finance | Illinois, United States | 525,306 | Unknown | Source |
| December 2025 | Stockton Cardiology Medical Group | Healthcare | California, United States | — | Unknown | Source |
| December 2025 | Upper Township | Government | New Jersey, United States | — | Unknown | Source |
| November 2025 | Surgery Center of Oak Ridge, LLC dba Advanced Family Surgery Center | Healthcare | Tennessee, United States | — | Unknown | Source |
| October 2025 | Community Health Action of Staten Island | Healthcare | New York, United States | — | Unknown | Source |
| September 2025 | River City Eye Care, LLC | Healthcare | Oregon, United States | — | Unknown | Source |
| September 2025 | Road To Hana, Inc. d/b/a Healthy Living | Food and Beverage | Vermont, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Genesis's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.