Threat-actor trackers

How these trackers work

Our breach ingest monitors public reporting and ransomware leak sites daily. When an incident is claimed by or attributed to a named group, it's added to that group's tracker automatically. "Claimed by" is not proof — extortion crews sometimes exaggerate or recycle old data — so every entry links to the full write-up with sources.

If an organization you use appears here

Treat your data as circulating. Stolen records get scraped into the same broker-and-dump ecosystem that doxxers and identity thieves search. The fastest way to know your real exposure is a free breach scan — it checks your email against 15.4B+ leaked records in about 15 seconds, including data tied to the groups above.