THREAT ACTOR
WALLSTREET_
ActiveWALLSTREET is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of WALLSTREET, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 17
Leak site mirrors
2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onionWallstreet | DLS snapshot · 2026-09-22 21:27 -
aifdajw7ptxmjnhi4xizvylw7bphct7rno7vikge2v2ddh5xoh3lmwqd.onionWallstreet | MISC snapshot · 2026-09-23 00:00
Recent victims
The 50 most recent victims claimed by WALLSTREET. Total in the index: 17.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-16 | Odyssey Charter School, Inc. | Odyssey Charter School, Inc. is a nonprofit organization operating tui… |
| 2026-09-16 | Roshd Sanat | Roshd Sanat is an Iranian industrial company providing engineering, ma… |
| 2026-09-10 | NcbChurch | New Covenant Believers’ Church is a faith-based ministry focused on sp… |
| 2026-09-10 | On Demand Occupational Medicine | On Demand Occupational Medicine provides occupational health, drug tes… |
| 2026-09-10 | Goldston Oil Corporation | Goldston Oil Corporation is a Houston-based oil and gas exploration an… |
| 2026-09-03 | America’s Food Basket | America’s Food Basket is a U.S. cooperative grocery-store network. Its… |
| 2026-09-02 | Ormond Beach Florida | Ormond Beach, Florida, is a scenic coastal city just north of Daytona … |
| 2026-09-01 | Total Education Solutions | TES IDEA provides personalized educational, therapeutic, and developme… |
| 2026-08-31 | Cedar County Memorial Hospital | Cedar County Memorial Hospital is a community hospital providing emerg… |
| 2026-08-30 | Andover | The Town of Andover, Massachusetts, is a municipal government organiza… |
| 2026-08-10 | T.RAD North America | T.RAD North America (tradna.com) is a Hopkinsville, Kentucky-based man… |
| 2026-08-10 | Black Hills Bentonite | Black Hills Bentonite LLC (bhbentonite.com) is a Wyoming-based produce… |
| 2026-07-05 | Gold Standard Automotive | Gold Standard Automotive Network administers vehicle service contracts… |
| 2026-07-05 | Baraga County Memorial Hospital | Baraga County Memorial Hospital is a critical access hospital serving … |
| 2026-07-04 | Asisken | Asisken (asisken.com) is a medical assistance/health insurance company… |
| 2026-07-04 | Edgewood Police Department | The Edgewood Police Department is part of the Pierce County Sheriff’s … |
| 2026-06-22 | Omax Autos | OMAX Autos Limited is a leading manufacturer of sheet metal components… |
CONFIRMED ATTACKS
Wallstreet confirmed attacks: 3 verified incidents
Ransomnews has verified 3 Wallstreet incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2026 to August 2026. United States accounts for 3 of them (100%). The most affected sector is healthcare, at 2 confirmed victims. Where a figure was disclosed (1 case), these incidents account for 501 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Wallstreet incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Cedar County Memorial Hospital | Healthcare | Missouri, United States | — | Unknown | Source |
| August 2026 | Town of Andover | Government | Massachusetts, United States | — | Unknown | Source |
| June 2026 | Baraga County Memorial Hospital | Healthcare | Michigan, United States | 501 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Wallstreet's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.