THREAT ACTOR
RAGNARLOCKER_
ActiveRAGNARLOCKER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of RAGNARLOCKER, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2023 31
- 2022 42
- 2021 19
- 2020 31
Leak site mirrors
10 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
rgleak7op734elep.onionsnapshot · 2021-09-08 00:04 -
rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onionThis site has been seized snapshot · 2026-09-23 02:00 -
p6o7m73ujalhgkiv.onionsnapshot · 2021-09-08 00:04 -
2dxxyil6kur3qpht2tkklupdgacrcbfun6qf5jmk3hafmt6n6ockbzid.onionsnapshot · 2024-12-10 16:08 -
goh2zbohdiblk23scvtae7delci5cioy73la2lnrduxutxksl7xiscqd.onionsnapshot · 2024-12-10 16:08 -
t2w5byhtkqkaw6m543i6ax3mamfdy7jkkqsduzzfwhfcep4shqqsd5id.onionsnapshot · 2024-12-10 16:08 -
wxbpssv4hiwlcgt4cxam3cznu4feqgf5pqfibbku3x6dwvtcakdkyeid.onionsnapshot · 2024-12-10 16:09 -
xxbsnxdqmthgpydddmuvg7yzy6pdfnlnlepxa5my4mjiqjsee6yidhyd.onionsnapshot · 2024-12-10 16:09 -
7twfgaqyik3xfuu4.onionsnapshot · 2024-12-10 16:09 -
ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onionThis site has been seized snapshot · 2026-09-23 03:00
Recent victims
The 50 most recent victims claimed by RAGNARLOCKER. Total in the index: 123.
| Date listed | Victim | Description |
|---|---|---|
| 2023-10-12 | Scotbeef Ltd. - Leaks | |
| 2023-10-11 | Eicon Controle Inteligentes | |
| 2023-10-06 | International Presence Ltd - Leaked | |
| 2023-10-05 | Learning Partnership West - Leaked | |
| 2023-10-03 | Groupe Fructa Partner - Leaked | |
| 2023-09-30 | Network Pacific Real Estate - Leak | |
| 2023-09-30 | Astre - Leaked | |
| 2023-09-25 | Stratesys Full data leak | |
| 2023-09-22 | Announcement: COMECA Group going to be Leaked | |
| 2023-09-22 | Announcement: Skatax Accounting company going to be leaked | |
| 2023-09-22 | Retail House - Full Leak | |
| 2023-09-21 | Announcement: Stratesys solutions going to be leaked | |
| 2023-09-21 | Announcement: Stratesys solutions going to b | |
| 2023-09-19 | Announcement: Groupe Fructa Partner will be leaked soon | |
| 2023-09-19 | CITIZEN company LEAKED | |
| 2023-09-17 | Announcement: Retail House going to be LEAKED | |
| 2023-09-15 | Updates: Israel "MYMC" | |
| 2023-09-06 | Israel Medical Center - leaked | |
| 2023-09-02 | DOIT - Canadian IT company allowed leak of its own clients. | |
| 2023-08-08 | Batesville didn't react on appeal and allows Full Leak | |
| 2023-07-31 | Announcement: Batesville Tool & Die, Inc will be leaked in 3 Days | |
| 2023-07-10 | Belize Electricity Limited - Leaked | |
| 2023-07-05 | Portugal Scotturb Data Leaked | |
| 2023-05-28 | Australian Universal Crane Leak | |
| 2023-05-18 | Autlan Metallorum, Mexican Miner Leak | |
| 2023-04-25 | CANTALK, Canadian translation services - Leak | |
| 2023-03-29 | Public Appeal to the CANTALK management | |
| 2023-03-29 | Temporary Leak Page #0013995NTa | |
| 2023-03-03 | New Leak in lawyers company AASP. | |
| 2023-03-03 | New Leak in lawyers company. | |
| 2023-02-22 | AASP claim there was no data leakage! | |
| 2022-12-28 | Hundred thousands of personal data, leak preview | |
| 2022-12-21 | Wrapex Industrial - Leaked | |
| 2022-12-20 | Serena Hotels - Leaked | |
| 2022-12-13 | ITONCLOUD - LEAKED | |
| 2022-11-25 | Essent company - Leaked | |
| 2022-11-22 | Leak Announcement - IT company ITonCLOUD | |
| 2022-11-16 | Belgium company Zwijndrecht - Leaked | |
| 2022-10-27 | DURAVIT A.G. - Announcement before publishing data | |
| 2022-10-19 | DIPF-INTERN - Leaked | |
| 2022-10-19 | Dollmar SpA - Leaked | |
| 2022-10-13 | Fashion company ZIGI NY - Leaked | |
| 2022-10-11 | DMCI Holding Leaked | |
| 2022-10-10 | TANG CAPITAL LEAKED | |
| 2022-10-06 | Avalon luxury transport company - Leaked | |
| 2022-10-04 | AudioQuest Data Leaked | |
| 2022-10-04 | Malayan Flour Mills Bhd. Data Leak | |
| 2022-09-19 | TAP Air Leak of more than 1.5 million of customers and many other. | |
| 2022-09-14 | DDoS instead of the Discuss - Nice try TAP Air | |
| 2022-09-14 | TAP AIR PORTUGAL - 115k personal data leak |
CONFIRMED ATTACKS
RagnarLocker confirmed attacks: 30 verified incidents
Ransomnews has verified 30 RagnarLocker incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2020 to August 2023. United States accounts for 12 of them (40%), with victims recorded in 15 countries in total. The most affected sector is utilities, at 6 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 7; the outcome is unrecorded in the remaining 22. Where a figure was disclosed (11 cases), these incidents account for 3,217,656 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified RagnarLocker incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2023 | Mayanei Hayeshua Medical Center | Healthcare | Bnei Brak, Israel | — | No | Source |
| July 2023 | Batesville Tool & Die, Inc. | Manufacturing | Indiana, United States | 4,549 | Unknown | Source |
| July 2023 | Belize Electricity Limited (BEL) | Utilities | Belize City, Belize | — | Unknown | Source |
| May 2023 | Universal Cranes (Smithbridge Group) | Construction | Murarrie, Australia | — | Unknown | Source |
| December 2022 | Azienda Ospedaliera di Alessandria | Healthcare | Alessandria, Italy | — | Unknown | Source |
| September 2022 | Politiezone Zwijndrecht (Police) | Government | Zwijndrecht, Belgium | — | No | Source |
| August 2022 | Puma Biotechnology, Inc. | Healthcare | California, United States | 1,933 | Unknown | Source |
| August 2022 | TAP Air Portugal | Transportation | Lisbon, Portugal | 115,000 | Unknown | Source |
| August 2022 | DESFA | Utilities | Athens, Greece | — | No | Source |
| June 2022 | Elbląskie Przedsiębiorstwo Energetyki Cieplnej | Utilities | Elbląg, Poland | — | Unknown | Source |
| May 2022 | Northern Data Systems, Inc. | Technology | Maine, United States | 506 | Unknown | Source |
| February 2022 | Smith Transport, Inc. | Transportation | Pennsylvania, United States | 10,141 | Unknown | Source |
| November 2021 | LDLC Group | Retail | Limonest, France | — | No | Source |
| June 2021 | Xoriant | Technology | California, United States | — | Unknown | Source |
| May 2021 | XtraSource | Technology | Enschede, Netherlands | — | Unknown | Source |
| May 2021 | ADATA | Manufacturing | Taipei, Taiwan | — | No | Source |
| March 2021 | TTEC | Service | Colorado, United States | 102,858 | Unknown | Source |
| February 2021 | Ness Digital Engineering (SwiftNess) | Service | Tel-Aviv, Israel | — | Unknown | Source |
| December 2020 | Dassault Falcon Jet Corporation | Manufacturing | New Jersey, United States | 44 | Unknown | Source |
| November 2020 | FINSA | Manufacturing | A Coruña, Spain | — | Unknown | Source |
| November 2020 | Campari Group | Food and Beverage | Sesto San Giovanni, Italy | 25,500 | Unknown | Source |
| November 2020 | Capcom | Technology | Osaka, Japan | 167,000 | No | Source |
| October 2020 | Biological E Ltd. | Healthcare | Hyderabad, India | — | Unknown | Source |
| September 2020 | Arthur J. Gallagher & Co | Finance | Illinois, United States | 2,785,130 | Unknown | Source |
| September 2020 | CMA CGM | Transportation | Marseille, France | — | Unknown | Source |
| July 2020 | CWT | Service | Minnesota, United States | — | Yes | Source |
| May 2020 | EDP Renewables North America | Utilities | Texas, United States | 4,995 | No | Source |
| May 2020 | Birch Communications, Inc. | Utilities | Georgia, United States | — | Unknown | Source |
| April 2020 | GST Autoleather Company | Manufacturing | Michigan, United States | — | Unknown | Source |
| April 2020 | Energias de Portugal (EDP) | Utilities | Lisbon, Portugal | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from RagnarLocker's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.