Actor index · ForensicPost

Desk live·

ShinyHunters34 files

2025–2026·SEV 5Dossier

Cloud, Education, Finance, Healthcare, Insurance, Manufacturing, Multiple, Retail, Technology, Telecom

Carhartt Leak Verifies at 12.9 Million — Half the Claim, Padded With Synthetic Records

Scattered Spider22 files

2023–2026·SEV 5Dossier

Aviation, Hospitality, Insurance, Multiple, Public sector, Retail, Transport

Four Arrested Over UK Retail Attacks Linked to Scattered Spider

LockBit17 files

2022–2026·SEV 5Dossier

Criminal, Education, Finance, Healthcare, Insurance, Logistics, Manufacturing, Multiple

The Attack Was in May and the Claim Arrived in June

2023–2026·SEV 5Dossier

Education, Healthcare, Logistics, Manufacturing, Multiple, Public sector, Travel

Cl0p Names More Than 40 Organisations in Its PTC Windchill Campaign

Black Basta13 files

2023–2025·SEV 5Dossier

Criminal, Healthcare, Multiple, Public sector, Water

Blockchain Analysis Put Black Basta Receipts Above $107 Million

2024–2026·SEV 5Dossier

Finance, Healthcare, Manufacturing, Multiple, Pharma, Telecom

Qilin Affiliates Linked to Exploitation of Check Point VPN Authentication Bypass

Salt Typhoon10 files

2024–2026·SEV 5Dossier

Salt Typhoon Campaign Reached More Than 600 Organisations Across 80 Countries

Scattered Lapsus$ Hunters10 files

2025–2026·SEV 5Dossier

Manufacturing, Multiple, Retail

Qantas Customer Data Published a Year After Third-Party Platform Breach

2023–2026·SEV 5

Government, Non-profit, Public sector, Technology

Rhysida Published 1.44 Million Berlin State Files After the City Refused 30 Bitcoin

Entertainment, Multiple, Retail, Telecom

Two Arrests, and No Names Here Yet

Change Healthcare Affected-Person Count Took Eleven Months to Settle

2023–2026·SEV 4

Cross-sector, Insurance, Multiple

Updated Medusa Advisory Puts Victims Past 500, and HHS Joins the Signatories

RansomHub4 files

Energy services, Healthcare, Retail, Telecom

The SEC Asked Halliburton to Explain Its Own Disclosure

The Company Dissolved, and the Records Did Not

DragonForce3 files

2025–2026·SEV 5

Cloud, Manufacturing

DragonForce Claims Attack on Pharmaceutical Manufacturer Kopran

The Contractor Approved the Eighteenth Prompt

Lazarus Group3 files

2022–2026·SEV 5

Defence, Finance, Financial services

Lazarus Paired a Windows Zero-Day With Post-Quantum Encryption Against Defence Firms

RansomHouse3 files

2025–2026·SEV 4

Cloud, Logistics, Retail

RansomHouse Claims Access to Trellix Source Code Repositories

Sandworm3 files

2022–2023·SEV 5

Public sector, Telecom, Telecommunications

Ukraine Says Sandworm Sat in Kyivstar for Months Before Destroying It

Termite Claims Blue Yonder Data and Says It Will Reuse the Email Lists

Cloudflare Says 104 API Tokens Were Exposed via Pasted Support Cases

Volt Typhoon3 files

2023–2026·SEV 5

Public sector, Utilities

Five Years in a Grid Network, and Nothing Was Stolen

Discovered the Same Day, Told the Clients Ten Weeks Later

ALPHV/BlackCat2 files

Retail, Technology

Reddit Says Phishing Took Source Code and Internal Documents, Not User Passwords

BlackSuit2 files

A Billion Dollars, Borne by People Who Were Not Attacked

Government, Not applicable

A Country Declared a National Emergency Over a Ransomware Attack

Daixin Team2 files

2022–2024·SEV 4

Aviation, Hospitality

Daixin Claimed Omni Hotels Guest Records Going Back to 2017

Dark Angels2 files

2023–2024·SEV 4

Manufacturing, Pharmaceutical distribution

The Largest Ransom on Record, and a Filing That Mentions No Ransom

Manufacturing, Retail

Three Hundred and Forty-Three Gigabytes, Claimed in November

Money Message2 files

Healthcare, Manufacturing

PharMerica Notified 5.8 Million People After a Two-Day Intrusion in March

2022–2023·SEV 5

Government, Technology

Play Published 65,000 Swiss Federal Documents Taken From Contractor Xplain

Healthcare, Manufacturing

Conduent Breach Affected More Than 62 Million People, Final Count Shows

Mandiant Traced the 3CX Compromise to a Trojanised X_TRADER Installer

The Company That Named the Technique Was Also Hit by It

Same Phish, Same Week, Two Companies, Two Outcomes

ALPHV, Cl0p1 file

ALPHV and Cl0p Both Listed Estee Lauder From Separate Intrusions

AXA Confirmed Ransomware in Four Asian Markets Nine Days After Its French Ransom Decision

Brain Cipher1 file

Rhode Island Benefits Breach Reached 650,000 People, 59% of the State

Cl0p, LockBit1 file

Cl0p and LockBit Both Exploited PaperCut a Month After the Patch Shipped

Clusters Alpha, Bravo, Charlie1 file

Sophos Found Three Chinese State-Linked Clusters Inside One Southeast Asian Government

CMD Organization1 file

Thirty Bitcoin, Ten Terabytes, One University

CyberAv3ngers1 file

A Pennsylvania Water Authority Lost a Booster Station to a Default Password

ExploitWhispers1 file

ExploitWhispers Published 200,000 Internal Black Basta Chat Messages

Green Blood1 file

Identity Card Issuance Stopped While the Claim Was Assessed

Six Agencies Warn Gunra Ransomware Runs on Leaked Conti Source Code

Homeland Justice1 file

Albania Severed Diplomatic Relations With Iran After July Cyberattack

IntelBroker1 file

Nokia Source Code Leaked From a Contractor’s Server With Default Logins

Interlock1 file

Interlock Held DaVita for 19 Days and Took Records on 2.7 Million People

Midnight Blizzard1 file

Microsoft Says Password Spray on a Legacy Test Account Reached Leadership Email

Mini Shai-Hulud1 file

GitHub Switched Two Poisoned Actions Back On, and 15,000 Repositories Reran the May Payload

Mr. Raccoon1 file

Thirteen Million Support Tickets, Allegedly, Through a Contractor

NetRunner1 file

NetRunner Demanded $100 Million From Nippon Medical School Hospital

NightSpire1 file

A Southeast Asian Energy Provider, and a Group Nobody Had Heard Of

Eight Terabytes, Claimed, From the Factory Floor of Everything

NullBulge1 file

Disney Slack Archive Published, Claimed at 1.1 Terabytes

Pawn Storm1 file

Pawn Storm Opened 2026 With an Office Zero-Day Against Ukraine and Partners

Payouts King1 file

UFP Technologies Warned of Billing and Shipment Delays After Attack

Predatory Sparrow1 file

Predatory Sparrow Published CCTV of Molten Steel Spilled at an Iranian Plant

The Company That Builds the Water System

RomCom Chained Firefox and Windows Zero-Days Into a Zero-Click Backdoor

Ryuk Conspirator Extradited From Ukraine Got 24 Months for a Campaign of 2,400 Attacks

Storm-05581 file

Storm-0558 Forged Tokens With a Stolen Microsoft Key to Read Government Email

Team 313 Outage Left 20,000 Chime Users Unable to Access Accounts

The Gentlemen1 file

Hospital Caribbean Medical Center Attack Affected About 92,000 People

Unattributed (RagnarLocker)1 file

Gallagher Disclosed Ransomware in a Filing; the Breach Behind It Took Nine Months to Describe

Barracuda Told Customers to Replace ESG Appliances Rather Than Patch Them

JumpCloud Says a Nation-State Phish Reached Fewer Than Five Customers

Vice Society1 file

Los Angeles Schools Refused to Pay and 500GB Including Psychological Assessments Was Published

World Leaks1 file

World Leaks Claims 630GB of Records From Tata Electronics

Yanluowang1 file

Cisco Breach Began With Corporate Credentials Synced to a Personal Google Account

A name here means published reporting attributed the activity to that group, at the confidence the file states. It is not a finding of this desk, and it is not a legal conclusion about any individual. Individuals are named in the corpus only after conviction.

ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreaches Ransomware Nation-state Cloud AI Insurance

DataCase files Data export Actor index Glossary Methodology

ContactSecure tips Corrections The desk Ethics

© 2026 ForensicPost Media · tips@forensicpost.comGlossary