THREAT ACTOR
STORM_
ActiveSTORM is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of STORM, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 64
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onionStorm Blog snapshot · 2026-09-23 03:21
Recent victims
The 50 most recent victims claimed by STORM. Total in the index: 64.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-21 | The Money Store | FinTech | Florham Park, New Jersey, United States | The Money Store is… |
| 2026-09-21 | TrueCore Behavioral Solutions | Healthcare | Tampa, Florida, United States | TrueCore Behavioral Solut… |
| 2026-09-21 | Manroc Developments | Manufacturing | Manitouwadge, Ontario, Canada | Manroc Developments In… |
| 2026-09-18 | American Casting Company | Manufacturing | Hollister, California, United States | American Castin… |
| 2026-09-18 | Johnson Investment Counsel | FinTech | Cincinnati, Ohio, United States | Johnson Investment Counsel… |
| 2026-09-18 | First Secure Community Bank | FinTech | Sugar Grove, Illinois, United States | First Secure Communit… |
| 2026-09-18 | The State Bank | FinTech | Wonder Lake, Illinois, United States | The State Bank Group … |
| 2026-09-18 | First Secure Bank and Trust | FinTech | Palos Hills, Illinois, United States | First Secure Bank and… |
| 2026-09-15 | McCarthy Tire Service | Manufacturing | Wilkes-Barre, Pennsylvania, United States | McCarthy T… |
| 2026-09-15 | PANTHERx Rare | Healthcare | Pittsburgh, Pennsylvania, United States | PANTHERx Rare i… |
| 2026-09-15 | Insight Credit Union | FinTech | Orlando, Florida, United States | Insight Credit Union offer… |
| 2026-09-13 | Canadian Mental Health Association | Healthcare | Toronto, Ontario, Canada | The Canadian Mental Health Ass… |
| 2026-09-09 | Technology Dynamics | Aerospace & Defense | Bergenfield, New Jersey, United States | Establi… |
| 2026-09-09 | Star Aviation, Inc | Aerospace & Defense | Oldham County, Kentucky, United States | Star Av… |
| 2026-09-09 | Valor Defense Solutions, Inc | Manufacturing | Odon, Indiana, United States | Valor Defense Solutions… |
| 2026-09-09 | Sprachakademie Rhein-Ruhr | Consulting | Duisburg, North Rhine-Westphalia, Germany | Sprachakademi… |
| 2026-09-09 | GSAC | FinTech | Downers Grove, Illinois, United States | GSAC Auto Financing… |
| 2026-09-09 | Superior Ag | Manufacturing | Huntington, Indiana, United States | Superior Ag is a … |
| 2026-09-09 | Ruggles Sign Company | Consulting | Versailles, Kentucky, United States | Ruggles Sign Compan… |
| 2026-09-09 | WindRose Health Network | Healthcare | Hope, Indiana, United States | WindRose Health Network (W… |
| 2026-09-09 | ITD Informations technologie | SaaS | Damme, Lower Saxony, Germany | ITD Informations technologie Gmb… |
| 2026-09-09 | Agrimac | Manufacturing | Warrnambool, Victoria, Australia | Agrimac achieves Au… |
| 2026-09-09 | 3-point Australia | Consulting | Melbourne, Victoria, Australia | 3-point Australia is a p… |
| 2026-09-09 | Westco Motors Cairns | Retail & E-commerce | Bungalow, Queensland, Australia | Westco Motors … |
| 2026-09-09 | GSAC Auto Financing | FinTech | Downers Grove, Illinois, United States | GSAC Auto Financing… |
| 2026-09-09 | Otto Sieve GmbH | Construction | Lohne, Lower Saxony, Germany | Otto Sieve GmbH is a fam… |
| 2026-09-09 | Flexmaster | Manufacturing | Richmond Hill, Ontario, Canada | Flexmaster, part of t… |
| 2026-09-09 | Rood & Riddle Equine Hospital | Healthcare | Lexington, Kentucky, United States | Rood & Riddle Equine… |
| 2026-09-09 | Chicago Partners Wealth Advisors | FinTech | Chicago, Illinois, United States | Chicago Partners Wealth A… |
| 2026-09-09 | Standard Tool & Die | Manufacturing | Stevensville, Michigan, United States | Standard Tool … |
| 2026-09-09 | Lowerys | Retail & E-commerce | Thunder Bay, Ontario, Canada | Lowerys is a prov… |
| 2026-09-09 | Tapper Cuddy LLP | Other | Winnipeg, Manitoba, Canada | Tapper Cuddy LLP is a full-servic… |
| 2026-09-09 | Melitron | Manufacturing | Guelph, Ontario, Canada | Melitron Corporation is a Ca… |
| 2026-09-09 | Macquarrie | Manufacturing | Melbourne, Victoria, Australia | Macquarrie specialize… |
| 2026-09-09 | Petrocare Construction | Construction | Saskatoon, Saskatchewan, Canada | Petrocare Constructio… |
| 2026-09-09 | Integra Castings | Manufacturing | Winkler, Manitoba, Canada | Integra Castings is an ISO… |
| 2026-09-09 | Sharp Motor Group | Retail & E-commerce | Tweed Heads, New South Wales, Australia | Sharp … |
| 2026-09-09 | Hinman Straub | Construction | Albany, New York, United States | Hinman Straub is a fu… |
| 2026-09-09 | Southern Metals Company | Retail & E-commerce | Charlotte, North Carolina, United States | South… |
| 2026-09-09 | SITES Medical | Healthcare | Columbia City, Indiana, United States | SITES Medical is … |
| 2026-09-09 | Penfold | Retail & E-commerce | Burwood, Victoria, Australia | Penfold Motor Gro… |
| 2026-09-09 | AutoDie | Manufacturing | Grand Rapids, Michigan, United States | Founded in 196… |
| 2026-09-09 | Proveli | Retail & E-commerce | Bloomington, Indiana, United States | Proveli is… |
| 2026-09-09 | Pinnacle Hospital | Healthcare | Crown Point, Indiana, United States | Pinnacle Healthcare… |
| 2026-09-09 | Ramsey Bros | Retail & E-commerce | Cleve, South Australia, Australia | Ramsey Bros … |
| 2026-09-09 | Phoenix Group of Companies | Manufacturing | Philadelphia, Pennsylvania, United States | The Phoeni… |
| 2026-09-09 | Schardein Mechanical | Construction | Louisville, Kentucky, United States | Schardein Mechani… |
| 2026-09-09 | Our Hospice Of South Central Indiana | Healthcare | Columbus, Indiana, United States | Our Hospice provides c… |
| 2026-09-09 | City of Mitchell | Consulting | Mitchell, South Dakota, United States | Mitchell is a cit… |
| 2026-09-09 | National Salvage | Energy | Bloomington, Indiana, United States | National Salvage is a l… |
CONFIRMED ATTACKS
Storm confirmed attacks: 7 verified incidents
Ransomnews has verified 7 Storm incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2026 to September 2026. Australia accounts for 4 of them (57%), with victims recorded in 2 countries in total. The most affected sector is retail, at 3 confirmed victims.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Storm incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | Macquarrie Corporation | Retail | Port Melbourne, Australia | — | Unknown | Source |
| August 2026 | Auto IT | Technology | Melbourne, Australia | — | Unknown | Source |
| August 2026 | Penfold Motors | Retail | Burwood, Australia | — | Unknown | Source |
| August 2026 | Sharp Motor Group | Retail | Tweed Heads, Australia | — | Unknown | Source |
| August 2026 | WindRose Health Network | Healthcare | Indiana, United States | — | Unknown | Source |
| August 2026 | City of Mitchell | Government | South Dakota, United States | — | Unknown | Source |
| August 2026 | Sawyer Savings Bank | Finance | New York, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Storm's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.