THREAT ACTOR
TERMITE_
ActiveTERMITE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of TERMITE, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 21
- 2025 17
- 2024 9
Leak site mirrors
5 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
termiteuslbumdge2zmfmfcsrvmvsfe4gvyudc5j6cdnisnhtftvokid.onionTermite snapshot · 2026-09-23 03:35 -
pqw3hepvky2pgyyv6dupvx47cm2gxzwop6dfei3i67dj76tdj6alplqd.onionIndex of / snapshot · 2024-12-17 07:26 -
4xklh64cl2lymm6n5xywinfq4wlchgugvv5a77pm3pta34svnohwl2id.onionIndex of / snapshot · 2025-05-08 09:19 -
wc4mc3oupskb2c3q4ba6tlf6tq5mdfoevsgfcotbnbsr4tbqoaomftid.onionIndex of / snapshot · 2025-09-10 23:01 -
y4bdg56uaznmbptf7dgp5xn3sjyyh4qodqjrsbziqatnyapmiqqctgid.onionIndex of / snapshot · 2026-09-23 05:22
Recent victims
The 50 most recent victims claimed by TERMITE. Total in the index: 47.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-22 | https://www.truamerica.com/ | TruAmerica Multifamily |
| 2026-09-22 | https://thelender.com/ | theLender |
| 2026-09-22 | https://www.sealconusa.com/ | Sealcon |
| 2026-08-22 | https://www.evergladesboats.com/ | Everglades Boats |
| 2026-07-28 | https://affiniahealthcare.org/ | Affinia Healthcare |
| 2026-07-28 | https://www.jdyoung.com/ | JD Young |
| 2026-06-10 | https://calfresh.ca.gov/ | Cal Fresh |
| 2026-06-09 | https://www.wieseusa.com/ | Wiese USA |
| 2026-06-09 | https://www.rolandmachinery.com/ | Roland Machinery |
| 2026-05-30 | https://www.imminet.com/ | Indiana Mills and Manufacturing |
| 2026-05-29 | https://www.uei.edu/ | UEI College |
| 2026-05-16 | https://www.ramarfoods.com/ | RAMAR FOODS INTERNATIONAL |
| 2026-04-17 | https://www.lanap.com/ | Millennium Dental Technologies |
| 2026-03-17 | https://www.nollandtam.com/ | Noll and Tam Architects |
| 2026-03-07 | https://www.cityofhuntington.com/ | City of Huntington |
| 2026-03-03 | https://www.bartramtrail.net/ | Bartram Trail Surveying |
| 2026-02-25 | https://www.joneshaberlaw.com/ | Jones Haber |
| 2026-02-25 | https://www.siskiyoutelephone.com/ | The Siskiyou Telephone |
| 2026-02-25 | https://www.artsbma.org/ | Birmingham Museum of Art |
| 2026-02-24 | https://insightchicago.com/ | Insight Hospital & Medical Center Chicago |
| 2026-02-02 | https://www.fhcenters.org/ | Family Health Center |
| 2025-12-25 | https://www.hermesmedical.com/ | Hermes Medical Solutions |
| 2025-12-17 | https://medhelpclinics.com/ | MedHelp |
| 2025-09-16 | https://www.npgco.com/ | News-Press & Gazette Co. |
| 2025-05-06 | https://www.lgm.fr/ | LGM |
| 2025-05-01 | https://www.ushio.eu/ | Ushio |
| 2025-04-12 | https://www.bjorklund.no/ | Bjørklund |
| 2025-04-11 | https://weareonit.com/ | On IT |
| 2025-03-16 | https://www.perrigo.com/ | Perrigo Company |
| 2025-02-26 | https://lbl.london/ | London Belgravia |
| 2025-02-26 | https://nationallegalservice.co.uk/ | National Legal Service |
| 2025-02-26 | https://rooksrider.co.uk/ | Rooks Rider Solicitors |
| 2025-02-26 | https://www.arcandco.com/ | Arcandco |
| 2025-02-26 | https://www.genea.com.au/ | Genea |
| 2025-02-20 | https://www.ligentia.com/ | Ligentia |
| 2025-02-12 | https://www.cesi.fr/ | CESI |
| 2025-01-30 | www.zschimmer-schwarz.com | Zschimmer and Schwarz |
| 2025-01-08 | https://www.huntingtonhotelgroup.com/ | Huntington Hotel Group |
| 2024-12-17 | https://tharisa.com/ | Tharisa |
| 2024-12-11 | http://watsonvillehospital.com | Watsonville Community Hospital |
| 2024-12-06 | https://blueyonder.com | Blue Yonder |
| 2024-11-20 | https://www.departement974.fr/ | Département de La Réunion |
| 2024-11-17 | https://csviamonde.ca/ | Conseil scolaire Viamonde |
| 2024-11-17 | https://www.lebenshilfe-heinsberg.de/ | Lebenshilfe Heinsberg |
| 2024-11-17 | https://oq.com/ | Oman Oil |
| 2024-11-17 | https://www.culligan.fr/ | Culligan |
| 2024-11-17 | https://www.nifast.com | Nifast |
CONFIRMED ATTACKS
Termite confirmed attacks: 16 verified incidents
Ransomnews has verified 16 Termite incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from October 2024 to May 2026. United States accounts for 6 of them (38%), with victims recorded in 10 countries in total. The most affected sector is healthcare, at 4 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 15. Where a figure was disclosed (3 cases), these incidents account for 19,804 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Termite incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| May 2026 | Roland Machinery Company | Retail | Illinois, United States | — | Unknown | Source |
| March 2026 | Perrigo Company plc | Healthcare | Dublin, Ireland | 1,060 | Unknown | Source |
| February 2026 | City of Huntington | Government | West Virginia, United States | — | Unknown | Source |
| January 2026 | Family Health Centers of Southern Indiana | Healthcare | Indiana, United States | 7,304 | Unknown | Source |
| September 2025 | News-Press & Gazette Company | Other | Missouri, United States | 11,440 | Unknown | Source |
| May 2025 | LGM Group | Service | Paris, France | — | Unknown | Source |
| April 2025 | Ushio Europe Group | Manufacturing | Oude Meer, Netherlands | — | Unknown | Source |
| March 2025 | Bjørklund Norge AS | Retail | Oslo, Norway | — | Unknown | Source |
| February 2025 | Ligentia | Transportation | London, United Kingdom | — | Unknown | Source |
| February 2025 | Genea | Healthcare | Sydney, Australia | — | Unknown | Source |
| February 2025 | CESI | Education | Puteaux, France | — | Unknown | Source |
| December 2024 | Tharisa | Other | Paphos, Cyprus | — | Unknown | Source |
| November 2024 | Watsonville Community Hospital | Healthcare | California, United States | — | Unknown | Source |
| November 2024 | Blue Yonder, Inc. | Technology | Arizona, United States | — | Unknown | Source |
| November 2024 | Département de La Réunion | Government | St Denis, Réunion | — | No | Source |
| October 2024 | Conseil scolaire Viamonde | Education | Toronto, Canada | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Termite's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.