THREAT ACTOR
RANSOMHOUSE_
ActiveRANSOMHOUSE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of RANSOMHOUSE, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
255
Victims tracked
11 / 186
Active mirrors
2022-08-18
First listing
2026-09-17
Most recent
Victims by year
- 2026 56
- 2025 67
- 2024 69
- 2023 42
- 2022 21
Leak site mirrors
186 mirrors tracked, 11 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion©RansomHouse snapshot · 2022-09-30 06:11 -
zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion©RansomHouse snapshot · 2026-09-23 05:38 -
q2injs6dqvzemu2kkfpk7u3lsrcn4rddip3h2a7oc6uqwq6vjnduamad.onion404 Not Found snapshot · 2026-05-21 12:00 -
b4k2fi62ctrid4k73itusuvcz5x5yczk27bpqdrsvwu3nl5mnz5dg3id.onionIndex of / snapshot · 2026-06-08 18:31 -
gfkngfw25qwhd2sn43x7cflcehk3bb7v2uifjndr2sc3k2abhqs22rad.onion404 Not Found snapshot · 2026-05-21 12:21 -
ge74uts2ybu22kzwahiayovxelbq5fwhywl73agev5w4fef2e5ikplid.onionIndex of / snapshot · 2026-06-08 18:01 -
xlirefmk3w2gsk3n5mkddinbfdatk6lhi7fj36knubhtoxiaqyus44yd.onionIndex of / snapshot · 2026-06-08 12:15 -
q2bwuip5xq4qjn2vyevprcddhk26cigyqfqfu6yki7korjys2rposaad.onion404 Not Found snapshot · 2026-05-21 12:12 -
nuhnnxg3owawo36mwdffyblbzplhthfswny55mh7yhbxq74en6jihyad.onion404 Not Found snapshot · 2026-05-21 12:00 -
m7vtnbsgctdcsccqmpnmi6igg3pcuiliqqqsq6uonkzg4blpa4eysiad.onionIndex of / snapshot · 2026-06-08 18:05 -
vopa354z4toilkjn4ileaf6rinkzn2givaokvj4yguq5kbiqoulxnzyd.onion404 Not Found snapshot · 2026-05-21 12:00 -
helc2q6kbiyz4cwegzlp5anigkbjsbowjxrjxv3j27rjbvycgr2qd2qd.onion404 Not Found snapshot · 2026-05-21 12:15 -
aw5q5nzdok52cgprlzik4n44qstoajrlbixqqukqqcennjyas4x4opad.onion404 Not Found snapshot · 2026-05-21 13:00 -
bffujdbkhxfs2y63haztye4txuqgbkttmtxuxzkrlnruyioak5aoohid.onion404 Not Found snapshot · 2026-05-21 13:00 -
swnoxbuqfh7dmbqzaigqllkkljspipnvft3a4offxh3m5zwxg6ob46ad.onion404 Not Found snapshot · 2026-05-21 12:00 -
nw4f4x2gix7y7y3nizwj2fnf5u4tqy2mwej62r6tdqye4s5ogrtftuid.onion404 Not Found snapshot · 2026-05-21 12:10 -
pnhyueueqsog3gbjuq3o7ixqbcdctpqnzv4uujsg3j76nt2bsm2p3rid.onion404 Not Found snapshot · 2026-05-21 12:00 -
oujq7kjgzj4r3fyvsb2wtz6bxycrvawqdtj6zqgljw7u4hwqsak34jqd.onion404 Not Found snapshot · 2026-05-21 11:00 -
jjgql4ddcs3hk5ptmfrpjriplialbjwi5a4tekffbfzv6n6oj5bmklid.onion404 Not Found snapshot · 2026-05-21 13:00 -
hyinn53atxthbme4n76ry76jiaohqd6uk35jwni32g6dqtqkaejgquid.onion404 Not Found snapshot · 2026-05-21 13:00 -
3nr2abdugd4mqabdmhialw3nbhol2qpywsphkocrhp6f7yxp3cps5iad.onion404 Not Found snapshot · 2026-05-21 12:26 -
blofpgq5q3talt3y2w3y6r3focrtrk7ugmwl3e6a4pjuf5t2tivkxbqd.onion404 Not Found snapshot · 2026-05-21 12:34 -
t7ezcjqq7h24gwswhyde72x4gkqxsjeyt2fxz44kcls6ipm4wd6bmsid.onionIndex of / snapshot · 2026-05-09 15:15 -
57yqe2tksgsmmwaqrxf45uaqy45t3hxu3dcnywjdks6lhtfztkpx57yd.onion404 Not Found snapshot · 2026-05-21 12:30 -
uvl645c47e5bozdzrrtjtm6pea5oltef63tsewz5ucmubvsj5i7meiid.onion404 Not Found snapshot · 2026-05-21 12:29 -
omdcwhef4ztuwhdiv3dbcgz2iyh2yb3gkkbusgvegbyjcacctahpxryd.onion404 Not Found snapshot · 2026-05-21 12:18 -
uv4sykhrapb2t3mnhw6imkbdym4fh6vstwcdsvbtzrvdwzcd5zzlylqd.onion404 Not Found snapshot · 2026-05-21 12:00 -
7yrwf73tckb4mtt2kms4qc7nr7rzghu3jdzycm4w4qq2nwrybi7hq7ad.onion404 Not Found snapshot · 2026-05-21 13:00 -
ggyosmcjq5vw7qimqhn2bf2gbr5zhdqmrfl35nnki6q5dmvblcqsmhyd.onion404 Not Found snapshot · 2026-05-21 12:25 -
rfbka2dt27wyuzymonzzx2zeaohx7sejti4gpihhc22hv74hya4h4vyd.onion404 Not Found snapshot · 2026-05-21 12:36
Recent victims
The 50 most recent victims claimed by RANSOMHOUSE. Total in the index: 255.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-17 | Pertamina | |
| 2026-09-17 | Namibian Defence Force | |
| 2026-09-15 | [DISCLOSED] California School Employees Association | |
| 2026-09-10 | California School Employees Association | |
| 2026-09-02 | [EVIDENCE]REXT Holdings Co., Ltd. | |
| 2026-09-01 | REXT Holdings Co., Ltd. | |
| 2026-08-18 | [DISCLOSED]Alya Construtora | |
| 2026-08-14 | [DISCLOSED]PCL Holding | |
| 2026-08-13 | [DISCLOSED]TECHVENTURES BANK S.A. | |
| 2026-08-12 | [DISCLOSED]City of Beacon | |
| 2026-08-10 | [DISCLOSED]City of McMinnville OR | |
| 2026-08-09 | [DISCLOSED]Nichirei | |
| 2026-08-07 | Alya Construtora | |
| 2026-08-06 | TECHVENTURES BANK S.A. | |
| 2026-08-06 | City of Beacon | |
| 2026-08-06 | lya Construtora | |
| 2026-08-06 | City of McMinnville OR | |
| 2026-08-03 | PCL Holding | |
| 2026-08-03 | [DISCLOSED]Fidelity Services Group | |
| 2026-07-22 | Nichirei | |
| 2026-07-16 | Megawork | |
| 2026-07-15 | Fidelity Services Group | |
| 2026-07-06 | [DISCLOSED]Prince George County | |
| 2026-07-03 | [EVIDENCE]Prince George County | |
| 2026-06-29 | Bonacio | |
| 2026-06-23 | [DISCLOSED]Karl Chevrolet | |
| 2026-06-17 | Prince George County | |
| 2026-06-16 | Promepla | |
| 2026-06-08 | Aegle Aviation | |
| 2026-06-08 | Ma Pak Leung Company Limited | |
| 2026-05-07 | Trellix (McAfee & FireEye) | |
| 2026-04-29 | Karl Chevrolet | |
| 2026-04-28 | Cybersecurity Vendor | |
| 2026-04-24 | Star Energy Geothermal Salak | |
| 2026-04-21 | Jiangsu Zenergy Battery Technologies Group Co., Ltd. | |
| 2026-04-17 | Winnitex (Americas) Limited | |
| 2026-04-13 | Transaction Packing Inc | |
| 2026-04-08 | [DISCLOSED]Accelerated Services | |
| 2026-04-06 | [DISCLOSED]Bioptik Technology | |
| 2026-03-26 | [DISCLOSED] Irec Sas | |
| 2026-03-13 | Irec Sas | |
| 2026-03-12 | Bioptik Technology | |
| 2026-02-27 | Neinver | |
| 2026-02-27 | Accelerated Services | |
| 2026-02-18 | [Internal database pack 4] Warren County Sheriff’s Office | |
| 2026-02-06 | Associated Endocrinologists | |
| 2026-02-05 | [Internal database pack 2] Warren County Sheriff’s Office | |
| 2026-02-04 | [Apple Data, Additional evidence (Apple Watch) pack-2]Luxshare Precision Industry Co. Ltd. | |
| 2026-01-30 | [Internal database pack 1] Warren County Sheriff’s Office | |
| 2026-01-29 | [Weapons License] Warren County Sheriff’s Office |
CONFIRMED ATTACKS
RansomHouse confirmed attacks: 63 verified incidents
Ransomnews has verified 63 RansomHouse incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from November 2021 to September 2026. United States accounts for 23 of them (37%), with victims recorded in 23 countries in total. The most affected sector is healthcare, at 14 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 10; the outcome is unrecorded in the remaining 53. Where a figure was disclosed (20 cases), these incidents account for 1,798,354 exposed records.
63Verified incidents
23Countries
2021–2026Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified RansomHouse incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | Namibian Defence Force | Government | Windhoek, Namibia | — | Unknown | Source |
| August 2026 | REXT Co., Ltd. | Retail | Tokyo, Japan | — | Unknown | Source |
| August 2026 | TechVentures Bank SA | Finance | Bucharest, Romania | — | Unknown | Source |
| July 2026 | Fidelity Services Group | Service | Gauteng, South Africa | — | Unknown | Source |
| July 2026 | Nichirei Corporation | Food and Beverage | Tokyo, Japan | 53,866 | Unknown | Source |
| June 2026 | Prince George County | Government | Virginia, United States | — | Unknown | Source |
| April 2026 | Karl Auto Group (Karl Chevrolet) | Retail | Iowa, United States | 500 | Unknown | Source |
| April 2026 | Trellix | Technology | Texas, United States | — | Unknown | Source |
| March 2026 | Vivaticket | Technology | Chasseneuil-du-Poitou, France | — | Unknown | Source |
| December 2025 | The Fedcap Group | Other | New York, United States | — | Unknown | Source |
| December 2025 | Warren County Sheriff's Office | Government | Kentucky, United States | — | Unknown | Source |
| December 2025 | Diaz Gill Medicina Laboratorial S.A. | Healthcare | Asunción, Paraguay | — | Unknown | Source |
| November 2025 | Fulgar S.p.A. | Manufacturing | Castel Goffredo, Italy | — | Unknown | Source |
| October 2025 | UnitedLayer | Technology | California, United States | 91,513 | Unknown | Source |
| October 2025 | Kulturrådet - Swedish Arts Council | Government | Stockholm, Sweden | — | Unknown | Source |
| October 2025 | Kurogane Kasei Co., Ltd. | Manufacturing | Nagoya, Japan | — | Unknown | Source |
| October 2025 | ASKUL Corporation | Retail | Tokyo, Japan | 740,000 | No | Source |
| October 2025 | WEBER GmbH | Manufacturing | Aschaffenburg, Germany | — | Unknown | Source |
| August 2025 | Greater Pittsburgh Orthopedic Associates, Inc. | Healthcare | Pennsylvania, United States | 56,954 | Unknown | Source |
| April 2025 | EUC Sjælland | Education | Naestved, Denmark | — | No | Source |
| April 2025 | OeTTINGER GETRÄNKE | Food and Beverage | Oettingen, Germany | — | Unknown | Source |
| April 2025 | Commune et CPAS de Jemeppe-sur-Sambre | Government | Jemeppe-sur-Sambre, Belgium | — | No | Source |
| February 2025 | The New Jersey Society of Certified Public Accountants | Other | New Jersey, United States | 2,670 | Unknown | Source |
| February 2025 | National Technology Co., Ltd. (Nationz Technologies Inc.) | Manufacturing | Shenzhen, China | — | Unknown | Source |
| January 2025 | Loretto Hospital | Healthcare | Illinois, United States | 435 | Unknown | Source |
| January 2025 | Supreme Administrative Court of Bulgaria | Government | Sofia, Bulgaria | — | Unknown | Source |
| November 2024 | Cell C | Utilities | Johannesburg, South Africa | — | Unknown | Source |
| October 2024 | Saneamento Básico do Estado de São Paulo (Sabesp) | Government | São Paulo, Brazil | — | Unknown | Source |
| August 2024 | Université Paris-Saclay | Education | Paris, France | — | No | Source |
| July 2024 | Valisana | Healthcare | Woluwe-Saint-Lambert, Belgium | — | Unknown | Source |
| July 2024 | Sibanye-Stillwater | Manufacturing | Libanon, South Africa | 7,258 | Unknown | Source |
| June 2024 | A-Apoteket | Healthcare | Horsholm, Denmark | — | No | Source |
| June 2024 | Francesco Parisi Casa di Spedizioni SpA | Transportation | Trieste, Italy | — | Unknown | Source |
| April 2024 | Lopesan Hotels | Other | Palmas de Gran Canaria, Spain | — | Unknown | Source |
| April 2024 | United Urology Group | Healthcare | Maryland, United States | 10,704 | Unknown | Source |
| March 2024 | Gantan Beauty Industry Co., Ltd | Manufacturing | Fujisawa City, Japan | — | Unknown | Source |
| March 2024 | Cressex Community School | Education | High Wycombe, United Kingdom | — | Unknown | Source |
| February 2024 | Webber International University | Education | Florida, United States | 5,251 | Unknown | Source |
| February 2024 | HAL Allergy | Healthcare | Leiden, Netherlands | — | Unknown | Source |
| December 2023 | Dameron Hospital | Healthcare | California, United States | 210,706 | Unknown | Source |
| November 2023 | HBL CPAs, P.C. | Finance | Arizona, United States | 1,206 | Unknown | Source |
| October 2023 | First Financial Security, Inc. | Finance | Georgia, United States | 105,764 | Unknown | Source |
| September 2023 | Hawkins Delafield & Wood LLP | Legal | New York, United States | — | Unknown | Source |
| September 2023 | Foursquare Healthcare Ltd | Healthcare | Texas, United States | 10,890 | Unknown | Source |
| September 2023 | Warren General Hospital | Healthcare | Pennsylvania, United States | 168,921 | Unknown | Source |
| September 2023 | Radley and Co | Retail | Milton Keynes, United Kingdom | — | Unknown | Source |
| July 2023 | Low Keng Huat Limited | Construction | Singapore, Singapore | 1,400 | Unknown | Source |
| April 2023 | Mission Community Hospital | Healthcare | California, United States | 269,847 | Unknown | Source |
| April 2023 | AvidXchange | Technology | North Carolina, United States | 6,495 | Unknown | Source |
| March 2023 | Tanbridge House School | Education | Horsham, United Kingdom | — | Unknown | Source |
| March 2023 | Comune di Taggia | Government | Taggia, Italy | — | No | Source |
| March 2023 | Hospital Clínic de Barcelona | Healthcare | Barcelona, Spain | — | Unknown | Source |
| January 2023 | Jeffries Morris, Inc. | Service | New York, United States | — | Unknown | Source |
| November 2022 | Keralty | Healthcare | Bogotá, Colombia | — | Unknown | Source |
| November 2022 | Vanuatu Government | Government | Port Vila, Vanuatu | — | No | Source |
| September 2022 | IPCA Laboratories | Healthcare | Mumbai, India | — | Unknown | Source |
| July 2022 | Unione dei Comuni Valdarno e Valdisieve | Government | Valdisieve, Italy | — | No | Source |
| June 2022 | The Shoprite Group | Food and Beverage | South Africa, South Africa | — | Unknown | Source |
| April 2022 | AHS Group | Transportation | Hamburg, Germany | — | Unknown | Source |
| January 2022 | AMD | Manufacturing | California, United States | — | Unknown | Source |
| December 2021 | Crum & Forster | Finance | New Jersey, United States | 13,974 | No | Source |
| December 2021 | Jefferson Credit Union | Finance | Alabama, United States | — | Unknown | Source |
| November 2021 | Saskatchewan Liquor and Gaming Authority (SLGA) | Government | Regina, Canada | 40,000 | No | Source |
Claimed vs confirmed. The figures above the fold on this page come from RansomHouse's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.