Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
    • Breach verification
  • Newsletter
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
    • Breach verification
  • Newsletter
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

SCATTERED-LAPSUS-HUNTERS · Threat actor profile

THREAT ACTOR

SCATTERED-LAPSUS-HUNTERS_

Active

SCATTERED-LAPSUS-HUNTERS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of SCATTERED-LAPSUS-HUNTERS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

51 Victims tracked
1 / 2 Active mirrors
2025-10-03 First listing
2025-10-11 Most recent

Victims by year

  • 2025 51

Leak site mirrors

2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

  • shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion snapshot · 2026-07-17 03:04
  • breachforums.hn This Domain Has Been Seized snapshot · 2026-09-23 05:17

Recent victims

The 50 most recent victims claimed by SCATTERED-LAPSUS-HUNTERS. Total in the index: 51.

Date listed Victim Description
2025-10-11 Engie Resources
2025-10-08 Telstra
2025-10-06 S&P Global (spglobal.com)
2025-10-06 CIC Vietnam
2025-10-06 Red Hat, Inc.
2025-10-06 Air France & KLM
2025-10-06 Saks Fifth
2025-10-06 Qantas Airways
2025-10-06 Puma
2025-10-06 Albertsons (Jewel Osco, etc)
2025-10-06 Toyota Motor Corporations
2025-10-03 1-800Accountant
2025-10-03 IKEA Over 14M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Chanel Over 1M+ records of Personally Identifiable Information (PII) have bee…
2025-10-03 TransUnion Over 13M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Pandora.net Over 34M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Cisco Over 1.4M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Google Adsense Over 2.5M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Air France-KLM Over 12.3M+ records of Personally Identifiable Information (PII) have …
2025-10-03 Saksfifth Over 1.1M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 CarMax Over 451k records containing sensitive Personally Identifiable Informa…
2025-10-03 Qantas Airways Limited Over 5M+ records of Personally Identifiable Information (PII) have bee…
2025-10-03 TripleA (aaa.com) Over 11.1M+ records of Personally Identifiable Information (PII) have …
2025-10-03 Adidas Over 20 million records containing sensitive Personally Identifiable I…
2025-10-03 Cartier Over 4.5M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Puma SE Over 6M+ records of Personally Identifiable Information (PII) have bee…
2025-10-03 Petco Over 94M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Instacart Over 39M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 HBO Max Over 7.7M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Kering (Gucci, Balenciaga, Brioni, AlexMcQ) Over 55M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Engie Resources (Plymouth) Over 537k+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Albertsons Companies, Inc. Over 672k+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Instructure.com - Canvas Over 2.3M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Fujifilm Over 224k+ records of Personally Identifiable Information (PII) have b…
2025-10-03 HMH (hmhco.com) Over 5.3M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 GAP, INC. Over 224k+ records of Personally Identifiable Information (PII) have b…
2025-10-03 ASICS Over 4.7M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 KFC Over 1M+ records of Personally Identifiable Information (PII) have bee…
2025-10-03 McDonalds Over 12M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Stellantis Over 18.2 million records containing sensitive Personally Identifiable…
2025-10-03 Walgreens Over 1.3M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Vietnam Airlines Over 23M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Marriott Over 1.1M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Home Depot Over 24M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Aeroméxico Over 39M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 UPS Over 29M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Republic Services Over 47M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 Disney/Hulu Over 94M+ records of Personally Identifiable Information (PII) have be…
2025-10-03 FedEx Over 166M+ records of Personally Identifiable Information (PII) have b…
2025-10-03 Toyota Motor Corporation Over 110 million records containing sensitive Personally Identifiable …

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

The Ransomnews Monthly

What leaked, what held up

One email a month: the datasets we verified, and the ones that fell apart under scrutiny.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

Free tool

How does your own site score?

Forty passive checks on TLS, security headers, email spoofing and privacy. A grade out of 100 in about fifteen seconds.

No signup. Nothing installed. We only request what your site already serves publicly.

Free tool

Were you in a leak?

Check whether an email address has surfaced in infostealer logs. No signup, no data stored.

Run StealerCheck

Live data

Ransomtracker

Victims as they are posted to ransomware leak sites, tracked continuously and checked against the claims.

Open the tracker

9,613 confirmed attacks tracked

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links; when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker
  • Site Check

Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.