THREAT ACTOR
LORENZ_
DormantLORENZ is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of LORENZ, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2023 22
- 2022 55
- 2021 19
- 2020 2
Leak site mirrors
4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onionLorenz snapshot · 2024-08-14 23:08 -
woe2suafeg6ehxivgvvn4nh6ectbdhdqgc4vzph27mmyn7rjf2c52jid.onionsnapshot · 2024-07-16 19:29 -
lorenzedzyzyjhzxvlcv347n5piltxamo755pzqpozh5l47kj7mxueid.onionsnapshot · 2024-12-10 04:56 -
lorenzezzwvtk3y24wfph4jpho27grrctqvf6yvld7256rnoz7yg2eid.onionsnapshot · 2024-12-10 04:57
Recent victims
The 50 most recent victims claimed by LORENZ. Total in the index: 98.
| Date listed | Victim | Description |
|---|---|---|
| 2023-12-11 | Bayer Heritage Federal Credit Union | |
| 2023-11-15 | EOS | |
| 2023-11-09 | Koh Brothers | |
| 2023-11-09 | Cogdell Memorial Hospital | |
| 2023-11-07 | Truck Bodies & Equipment International | |
| 2023-10-25 | Broad River Retail/Ashley Store | |
| 2023-10-02 | AllCare Pharmacy | |
| 2023-09-12 | BF&S Civil Engineers | |
| 2023-09-12 | Dee Sign | |
| 2023-08-30 | Felling Trailers, Inc. | |
| 2023-04-05 | Tarolli, Sundheim, Covell & Tummino LLP | |
| 2023-04-05 | Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa | |
| 2023-04-05 | NGS Super | |
| 2023-04-05 | Intrasect Technologies | |
| 2023-04-05 | Moore Engineering | |
| 2023-03-14 | Manning Building Supplies | |
| 2023-03-14 | Tarolli | |
| 2023-02-20 | Hopsteiner | |
| 2023-02-06 | AmerisourceBergen/Censora - MWI Animal Health | |
| 2023-01-10 | Chestertons Inc. | |
| 2023-01-10 | Thor Specialties, Inc. | |
| 2023-01-10 | Shelco | |
| 2022-12-07 | Albina Asphalt | |
| 2022-11-30 | Holler-Classic | |
| 2022-11-14 | Nissan of Las Cruces | |
| 2022-11-14 | Salud Family Health | |
| 2022-11-10 | Main & Main Capital Group | |
| 2022-10-27 | Miracapo pizza company | |
| 2022-10-18 | Wes-tec inc. | |
| 2022-09-17 | Turner Enterprises, Inc. | |
| 2022-09-17 | Ward Hadaway | |
| 2022-09-17 | Northern Contours Inc. | |
| 2022-09-17 | Laddawn Inc. | |
| 2022-08-23 | Engine Power | |
| 2022-08-22 | Northern Contours | |
| 2022-08-18 | Airtech | |
| 2022-08-18 | Tygavac | |
| 2022-08-18 | Wolfe Eye Clinic | |
| 2022-08-18 | Challenge-mfg | |
| 2022-08-18 | Turner Enterprises | |
| 2022-08-18 | Hensoldt | |
| 2022-08-18 | VadaTech | |
| 2022-08-18 | Wardhadaway | |
| 2022-08-18 | DeeZee | |
| 2022-08-18 | Musco | |
| 2022-08-18 | Tosoh | |
| 2022-08-18 | Brunk | |
| 2022-08-18 | Fuji | |
| 2022-08-18 | Bonneville | |
| 2022-08-18 | Wis-Pak |
CONFIRMED ATTACKS
Lorenz confirmed attacks: 19 verified incidents
Ransomnews has verified 19 Lorenz incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2020 to December 2023. United States accounts for 12 of them (63%), with victims recorded in 6 countries in total. The most affected sector is healthcare, at 5 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 17. Where a figure was disclosed (11 cases), these incidents account for 883,768 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Lorenz incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| December 2023 | Koh Brothers Group Limited | Construction | Singapore, Singapore | 11,718 | Unknown | Source |
| October 2023 | Cogdell Memorial Hospital | Healthcare | Texas, United States | 86,981 | Unknown | Source |
| October 2023 | Bayer Heritage Federal Credit Union | Finance | West Virginia, United States | 61,165 | Unknown | Source |
| September 2023 | W.P. Malone, Inc. d/b/a AllCare Pharmacy | Healthcare | Arkansas, United States | 16,341 | Unknown | Source |
| March 2023 | NGS Super | Technology | Melbourne, Australia | — | No | Source |
| February 2023 | Joy Cone Co. | Food and Beverage | Pennsylvania, United States | 3,099 | Unknown | Source |
| February 2023 | Manning Building Supplies | Retail | Florida, United States | 1,044 | Unknown | Source |
| November 2022 | AmerisourceBergen - MWI Animal Health | Healthcare | Idaho, United States | — | Unknown | Source |
| September 2022 | Salud Family Health | Healthcare | Colorado, United States | 427,546 | Unknown | Source |
| September 2022 | Laddawn, Inc. | Manufacturing | Massachusetts, United States | 1,451 | Unknown | Source |
| March 2022 | Ward Hadaway | Legal | Newcastle, United Kingdom | — | Unknown | Source |
| March 2022 | Musco Sports Lighting LLC | Manufacturing | Iowa, United States | 275 | Unknown | Source |
| January 2022 | Hensoldt | Technology | Taufkirchen, Germany | — | Unknown | Source |
| November 2021 | Headwaters Health Care Centre (HHCC) | Healthcare | Orangeville, Canada | — | Unknown | Source |
| November 2021 | Component Assembly Systems, Inc. (CAS) | Construction | New York, United States | 33 | Unknown | Source |
| July 2021 | Trifecta Networks | Technology | Florida, United States | — | Unknown | Source |
| May 2021 | Langs Building Supplies | Retail | Stapylton, Australia | — | No | Source |
| December 2020 | Commport Communications | Technology | Aurora, Canada | — | Unknown | Source |
| August 2020 | Bansley and Kiener, L.L.P. | Finance | Illinois, United States | 274,115 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Lorenz's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.