THREAT ACTOR
KAZU_
ActiveKAZU is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KAZU, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 19
- 2025 41
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onionKAZU snapshot · 2026-09-23 05:25
Recent victims
The 50 most recent victims claimed by KAZU. Total in the index: 60.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-07 | MSM Unify: Global Education Platform - CA | MSM Unify is a global education technology platform that helps student… |
| 2026-09-07 | Statistics South Africa – Official National Data and Insights Portal | the official online portal of South Africa’s national statistics agenc… |
| 2026-09-07 | Gauteng City Region Academy (GCRA) | government-funded program that helps students from Gauteng Province pu… |
| 2026-09-07 | HealthDaq | Healthdaq is a company that helps hospitals and care providers hire st… |
| 2026-09-07 | Health Time | HT Médica is a comprehensive imaging diagnostic center that offers adv… |
| 2026-09-07 | Natclar (S.G. Natclar S.A.C.) | Peruvian occupational health services company headquartered in Lima an… |
| 2026-09-07 | Gauteng Provincial Government | Gauteng Provincial Government Breach ( www.gauteng.gov.za ) Official … |
| 2026-09-07 | ConsultorioMovil: Telemedicine and Healthcare System | digital healthcare platform designed to help doctors, clinics, and med… |
| 2026-09-07 | Meducar: Telemedicine and Patient Management System | Meducar is a Latin American healthtech platform that provides software… |
| 2026-09-07 | Centro Médico Especializado OSI: Healthcare Solutions | Centro Médico Especializado OSI is a healthcare provider based in Peru… |
| 2026-09-07 | Dr Akbar Niazi Teaching Hospital | Dr. Akbar Niazi Teaching Hospital (ANTH) is a 500-bed tertiary care te… |
| 2026-09-07 | PawlyClinic: Digital Veterinary Care Platform | PawlyClinic is a digital veterinary care platform that connects pet ow… |
| 2026-09-07 | Canada Yocale: Appointment Management System | Yocale is a cloud-based business management platform that helps appoin… |
| 2026-09-07 | Brazil Mobilemed: Cloud PACS Platform | Mobilemed is a Brazil-based health technology company that provides a … |
| 2026-09-07 | Instituto Ferrero de Neurología y Sueño | Instituto Ferrero de Neurología y Sueño (IFN) is a specialized medical… |
| 2026-09-07 | PappyJoe: Healthcare Management System | PappyJoe is an India-based healthcare technology company that provides… |
| 2026-09-07 | Spirit Cultural Exchange - US | Spirit Cultural Exchange is a U.S.-based organization that provides in… |
| 2026-01-26 | zHealthEHR — Practice Management Software for Chiropractic & Wellness Clinics | zHealthEHR is a cloud-based electronic health record (EHR) and practic… |
| 2026-01-12 | MyVete | MyVete is a veterinary software designed to help animal clinics and ve… |
| 2025-12-30 | ManageMyHealth - New Zealand | ManageMyHealth is a New Zealand-based online platform that enables ind… |
| 2025-12-29 | Saudi Icon | Saudi Icon specializes in design and build solutions, offering a holis… |
| 2025-12-11 | Leadway Assurance | Leadway Assurance Company Limited is the leading insurance provider in… |
| 2025-12-06 | CT Dent Ltd | CT Dent Ltd is an independent CBCT imaging centre based in London, UK,… |
| 2025-11-12 | National Civil Service Commission of Colombia | The official portal of the Comisión Nacional del Servicio Civil (CNSC)… |
| 2025-11-12 | The Society of Engineers - UAE | The Society of Engineers - UAE is a professional, non-profit organizat… |
| 2025-11-10 | Defensoría del Pueblo de Colombia – Protection and Promotion of Human Rights | The official online portal of the Defensoría del Pueblo de Colombia, a… |
| 2025-11-10 | Doctor Alliance – Streamlined Document and Billing Management for Healthcare Providers | Doctor Alliance (doctoralliance.com) is a U.S.-based healthcare techno… |
| 2025-11-10 | GOBIERNO DE GUANAJUATO | The official platform of the Secretaría de Gobierno de Guanajuato, use… |
| 2025-11-10 | Venezuela’s Cooperative Registration and Management System | The official online platform for the Integrated Management System for … |
| 2025-11-10 | Official Website of the Municipality of Querétaro | The official online portal of the Municipio de Querétaro, the local go… |
| 2025-11-10 | Official Website of Vehicle Emissions Control (VEC Mexico) | VEC (Vehicle Emissions Control S.A. de C.V.), a private company based … |
| 2025-11-10 | National Entrepreneur System of Mexico | The official platform created by the Mexican government to support ent… |
| 2025-11-10 | Guadalajara Social Assistance Agency | Sistema DIF Guadalajara is a public social service agency operated by … |
| 2025-11-10 | Nepal official Police Website | The Nepal Police is a national law enforcement agency of Nepal, establ… |
| 2025-11-10 | Saudi Arabia Gov - Taif Municipality Portal | The official digital portal of the City of Taif, located in Makkah Pro… |
| 2025-11-10 | Official Platform for Employability Certification in Mauritania | The official Mauritanian government platform for the Qualification and… |
| 2025-11-10 | Bolivian Military Social Security Corporation – COSSMIL | The website cossmil.mil.bo belongs to COSSMIL (Corporación del Seguro … |
| 2025-11-10 | Ministry of Health – Government of Sri Lanka | The official online portal of the Ministry of Health in Sri Lanka. It … |
| 2025-11-10 | Zacatecas State Department of Education | The official portal of the Secretaría de Educación del Estado de Zacat… |
| 2025-11-10 | Official Website of the Bolivian Navy (Armada Boliviana) | The official portal of the Armada Boliviana (Bolivian Navy), the marit… |
| 2025-11-10 | Official Job Portal of the Mexican Government - V2 | Mexico's official government job portal operated by the Servicio Nacio… |
| 2025-11-10 | Secretaría de Educación de Quintana Roo | The official website of the Secretaría de Educación de Quintana Roo (S… |
| 2025-11-10 | Colombian Navy Recruitment Portal | The official recruitment platform of the Colombian Navy (Armada Nacion… |
| 2025-11-10 | Colombian Military PII + Firearms Permit Docs | The official portal of the General Command of the Military Forces of C… |
| 2025-11-10 | Colombian Government Employment Portal | The official website of Colombia’s Public Employment Service (Servicio… |
| 2025-11-10 | Official Portal of Argentina’s Ministry of Education | the official portal of the Ministry of Education of Argentina. It prov… |
| 2025-11-10 | Official Job Portal of the Mexican Government | Mexico's official government job portal operated by the Servicio Nacio… |
| 2025-11-10 | Criminal Justice and Public Services - San Luis Potosí Prosecutor | the official online portal for managing public procedures offered by t… |
| 2025-11-10 | IRAN Job Seekers Platform | Job search portal based in Iran, designed to connect job seekers with … |
| 2025-11-10 | Thailand National Police | The official government platform used by the Royal Thai Police to mana… |
CONFIRMED ATTACKS
Kazu confirmed attacks: 5 verified incidents
Ransomnews has verified 5 Kazu incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2025 to January 2026. United States accounts for 2 of them (40%), with victims recorded in 3 countries in total. The most affected sector is healthcare, at 3 confirmed victims. Where a figure was disclosed (2 cases), these incidents account for 136,810 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Kazu incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| January 2026 | zHealth, Inc. | Healthcare | California, United States | 118,563 | Unknown | Source |
| December 2025 | Manage My Health | Healthcare | Auckland, New Zealand | — | Unknown | Source |
| October 2025 | Doctor Alliance | Healthcare | Texas, United States | 18,247 | Unknown | Source |
| July 2025 | Fiscalía General del Estado de San Luis Potosí | Government | San Luis Potosí, Mexico | — | Unknown | Source |
| June 2025 | Sistema DIF Guadalajara | Government | Guadalajara, Mexico | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Kazu's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.