THREAT ACTOR
SNATCH_
ActiveSNATCH is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of SNATCH, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
143
Victims tracked
1 / 11
Active mirrors
2021-11-29
First listing
2024-05-15
Most recent
Victims by year
- 2024 15
- 2023 62
- 2022 42
- 2021 24
Leak site mirrors
11 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
hl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onionNews snapshot · 2023-11-02 08:07 -
snatch.pressNews snapshot · 2022-12-13 00:04 -
snatchteam.ccsnapshot · 2024-09-12 15:02 -
snatchnews.topJust a moment... snapshot · 2024-12-16 01:07 -
snatch6rpvi7yy4t.onionsnapshot · 2025-07-08 18:17 -
snatch2q72f2wjff.onionsnapshot · 2025-07-08 18:17 -
snatchh5ssxiorrn.onionsnapshot · 2025-07-08 18:17 -
snatch6brk4nfczg.onionsnapshot · 2025-07-08 18:18 -
snatchwezarcr27t.onionsnapshot · 2025-07-08 18:18 -
snatch24uldhpwrm.onionsnapshot · 2025-07-08 18:18 -
mydatassuperhero.comsnapshot · 2026-09-23 05:12
Recent victims
The 50 most recent victims claimed by SNATCH. Total in the index: 143.
| Date listed | Victim | Description |
|---|---|---|
| 2024-05-15 | Neovia | La société néovia a été crée en 2003 par trois ingénieurs informaticie… |
| 2024-05-01 | UK government | More information in our telegram channel https://t.me/snatch_teamRishi… |
| 2024-04-15 | The Royal Family of Great Britain | Charles III, the KingCamilla, the QueenWilliam, Prince of WalesCatheri… |
| 2024-03-28 | Miki Travel Limited | MIKI Travel has a dedicated team of hundreds of multilingual, professi… |
| 2024-03-24 | Dörr Group | Dürfen wir uns vorstellen? Wir sind Evelyn und Rainer Dörr. Wir sind S… |
| 2024-03-24 | Butler, Lavanceau & Sober | Butler, Lavanceau & Sober, LLC is a certified public accounting firm c… |
| 2024-03-24 | Retirement Line | Retirement Line is the UK's largest pension income broker*. We are com… |
| 2024-03-07 | Seven Seas Group | Seven Seas is a global maritime services group that specializes in pro… |
| 2024-03-02 | Frencken | More information in our telegram channel https://t.me/snatch_team Pers… |
| 2024-03-02 | HSPG & Associates | 180 GB , 205,877 Files, 25,598 Folders of confidential information has… |
| 2024-02-17 | Hawbaker Engineering | Hawbaker Engineering was born from a desire to build upon our wealth o… |
| 2024-02-02 | US government (private data) +Rothschild&Rockefeller | More information in our telegram channel https://t.me/snatch_teamIf yo… |
| 2024-01-13 | Charm Sciences | More information in our telegram channel https://t.me/snatch_team Pers… |
| 2024-01-13 | Malabar Gold & Diamonds | Malabar Group was founded in 1993 by a team of enterprising entreprene… |
| 2024-01-13 | Banco Promerica | Grupo Promerica es un conjunto de instituciones financieras enlazadas … |
| 2023-12-17 | Kraft Foods | For 150 years, Kraft Heinz has produced some of the world's most belov… |
| 2023-12-17 | Spaulding Clinical | Founded in 2007, Spaulding Clinical is a full-service, state-of-the-ar… |
| 2023-12-02 | Jerry Pate Energy (hack from Saltmarsh Financial Advisors) | Jerry Pate Company is the premier provider of outdoor beautification p… |
| 2023-11-29 | Hunt Guillot & Associates | HGA is a multi-disciplined project management and engineering services… |
| 2023-11-29 | ALVImedica | We are a global innovator of unique interventional medical devices, co… |
| 2023-11-29 | Kologik | More information in our telegram channel https://t.me/snatch_team Pers… |
| 2023-11-29 | Canadian Psychological Association | The Canadian Psychological Association (CPA) is the primary organizati… |
| 2023-11-16 | Museum für Naturkunde | The Museum für Naturkunde Berlin has a long and eventful history - it … |
| 2023-11-16 | Mediafax Group | Mediafax Group este locul de întâlnire al pasionaţilor de sport, auto,… |
| 2023-11-16 | Tyson Foods | We built our name on providing generations of families with wholesome,… |
| 2023-11-16 | Maldives Ports Limited | The Maldives Ports Limited brings together decades’ experience in comm… |
| 2023-11-16 | Montachusett Regional Vocational Technical School District | Montachusett Regional Vocational Technical School, also known as Monty… |
| 2023-11-02 | Detroit Symphony Orchestra | The Detroit Symphony Orchestra, America’s fourth-oldest, has a history… |
| 2023-10-25 | M&n Management | M&N Management has been in business for greater than 25 years. What ma… |
| 2023-10-25 | Ancillae-Assumpta Academy | As a private Catholic elementary school, Ancillae-Assumpta Academy has… |
| 2023-10-16 | Cogal Industry | Dal 1949 COGAL INDUSTRY® produce una vasta gamma di biancheria per la … |
| 2023-10-14 | Intech | More information in our telegram channel https://t.me/snatch_team Pers… |
| 2023-10-11 | Alliance Virgil Roberts Leadership Academy | Alliance College-Ready Public Schools is committed to building an anti… |
| 2023-09-19 | CEFCO | We have been in the fuel business a long time – since 1952, in fact. D… |
| 2023-09-19 | ZILLI | ZILLI works with ultra-fine calfskin suede and glazed lambskin, but al… |
| 2023-09-19 | Florida Department of Veterans' Affairs | Watching over and advocating for our state’s veterans and their famili… |
| 2023-09-04 | Knight Barry Title | We are produly present over 10TB ofcommercial data (customer data, fin… |
| 2023-08-27 | Fullerton India (SMFG India Credit) | More information in our telegram channel https://t.me/snatch_info Pers… |
| 2023-08-21 | Department of Defence South African (DARPA) | Military contracts, internal call signs and personal data |
| 2023-08-21 | Department of Defence South African | |
| 2023-07-29 | Alinabal | Alinabal is a broadly diversified manufacturer with history reaching a… |
| 2023-07-18 | Tampa general hospital | Tampa General Hospital is a private not-for-profit hospital and one of… |
| 2023-07-18 | Seasia Infotech | Seasia has established itself as an industry-leader when it comes to o… |
| 2023-07-18 | Ningbo Joyson Electronic Corp. | Ningbo Joyson Electronic Corp. is one of the best automotive suppliers… |
| 2023-07-18 | Wasserstrom | The Wasserstrom Company, which began as a local, family-run business, … |
| 2023-07-14 | Snatch News | Our new telegram channel! Analytics, security articles, additional pub… |
| 2023-06-21 | Medical University of the Americas | Newly Reduced Tuition Makes MUA Accessible and Affordable. It is a gre… |
| 2023-06-20 | Telcoset | Why Choose Telcoset? Having an experienced staff, providing project ma… |
| 2023-06-14 | Hemenway Financial Services | Since 1986, Hemenway Associates, Inc. has provided a comprehensive off… |
| 2023-06-14 | MCNA Dental | MCNA is dedicated to promoting high-quality and cost-effective oral he… |
CONFIRMED ATTACKS
Snatch confirmed attacks: 30 verified incidents
Ransomnews has verified 30 Snatch incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2019 to February 2024. United States accounts for 19 of them (63%), with victims recorded in 11 countries in total. The most affected sector is healthcare, at 6 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 4; the outcome is unrecorded in the remaining 26. Where a figure was disclosed (16 cases), these incidents account for 1,009,180 exposed records.
30Verified incidents
11Countries
2019–2024Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Snatch incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| February 2024 | Butler, Lavanceau & Sober, LLC | Finance | Maryland, United States | 3,370 | Unknown | Source |
| November 2023 | Spaulding Clinical Research, LLC | Healthcare | Wisconsin, United States | 884 | Unknown | Source |
| October 2023 | Montachusett Regional Vocational Technical School District (Monty Tech) | Education | Massachusetts, United States | 3,746 | Unknown | Source |
| September 2023 | Detroit Symphony Orchestra | Other | Michigan, United States | 6,778 | Unknown | Source |
| September 2023 | Alliance College Ready Public Schools | Education | California, United States | 8,793 | Unknown | Source |
| August 2023 | Knight Barry Title | Service | Wisconsin, United States | 44,910 | Unknown | Source |
| August 2023 | South African Defence Force (SANDF) | Government | Pretoria, South Africa | — | No | Source |
| May 2023 | Bunker Hill Community College | Education | Massachusetts, United States | 195,588 | Unknown | Source |
| May 2023 | Chattanooga State Community College | Education | Tennessee, United States | 1,244 | No | Source |
| May 2023 | Canadian Nurses Association | Healthcare | Ottawa, Canada | — | Unknown | Source |
| April 2023 | Mount Desert Island Hospital, Inc. | Healthcare | Maine, United States | 32,661 | Unknown | Source |
| April 2023 | Medical Society of the State of New York | Healthcare | New York, United States | — | Unknown | Source |
| February 2023 | Gaston College | Education | North Carolina, United States | 191,324 | No | Source |
| February 2023 | Modesto Police Department | Government | California, United States | 2,280 | No | Source |
| December 2022 | Metropolitan Opera | Other | New York, United States | 49,486 | Unknown | Source |
| October 2022 | Telcoset | Technology | Istanbul, Turkey | 1,000 | Unknown | Source |
| September 2022 | Daylesford | Retail | Daylesford, United Kingdom | — | Unknown | Source |
| August 2022 | Atlantic Dialysis Management Services, LLC | Healthcare | New York, United States | 16,121 | Unknown | Source |
| January 2022 | Hanon Systems | Manufacturing | Daejeon, South Korea | — | Unknown | Source |
| January 2022 | Clinica Integral de Emergencias Laura Daniela (CIELD) | Healthcare | Valledupar, Colombia | — | Unknown | Source |
| December 2021 | Saskatoon John Diefenbaker International Airport | Transportation | Saskatoon, Canada | — | Unknown | Source |
| December 2021 | Fittingbox | Technology | Labège, France | — | Unknown | Source |
| November 2021 | Volvo | Manufacturing | Gothenburg, Sweden | — | Unknown | Source |
| February 2021 | InTown Suites Management, Inc. | Other | Georgia, United States | 10,995 | Unknown | Source |
| November 2019 | SmarterASP.NET | Technology | California, United States | 440,000 | Unknown | Source |
| May 2019 | Perceptics | Manufacturing | Tennessee, United States | — | Unknown | Source |
| May 2019 | Tecnicas Hidraulicas | Manufacturing | Bizkaia, Spain | — | Unknown | Source |
| May 2019 | KCSA | Service | New York, United States | — | Unknown | Source |
| May 2019 | Myatt Blume & Osburn | Finance | Texas, United States | — | Unknown | Source |
| May 2019 | BMK | Finance | Dammam, Saudi Arabia | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Snatch's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.