SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

brain cipher

30 Einträge insgesamt

Zeitraum: 31.08.2026 – 21.10.2026

Brain Cipher ransomware surfaced in mid-2024, rapidly gaining notoriety after a high-impact attack on Indonesia’s National Data Center, which disrupted over 160 government services including immigration systems. The group operates with a double-extortion model, encrypting data using a LockBit 3.0-based payload (Salsa20/RSA hybrid) and threatening leaks via a Tor-hosted portal. Distinct behaviors include encrypting both file contents and filenames, and customizing encrypted file names with appended random extensions. Initial access methods include phishing and purchases from initial-access brokers. Ransom demands have ranged from tens of thousands up to $8 million USD, though victims have sometimes been offered decryption keys without payment. Victims span sectors such as government, healthcare, education, media, and manufacturing across Southeast Asia, Europe, and the Americas.

Veröffentlichungskanäle

  • Leak-Seite · Brain Cipher Client Area · zuletzt nicht erreichbar
  • Leak-Seite · Brain Cipher Dataleak · zuletzt nicht erreichbar
  • Dateiablage · zuletzt nicht erreichbar
  • Chat · BrainCipher Client Area · zuletzt nicht erreichbar
  • Dateiablage · Brain Cipher FileSharing · zuletzt nicht erreichbar
  • Dateiablage · Not Found · zuletzt nicht erreichbar
  • Dateiablage · BrainCipher Storage · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Keine Meldung im Bestand nennt diese Gruppe — sie arbeitet unbeachtet. Das ist der Regelfall: von 81 aktiven Gruppen haben 23 ein Medienecho.

Neueste Einträge

Filter zurücksetzen
brain ciphernovagroupgbc.comGB

Beschreibung der Täter

Total size - 70GB. Contents: Invoices with numbers and amounts, draw payment schedules, unit costs; reports listing owners' names; property details. If you think you are here by m...

Herkunft

brain cipherclinicaromero.comAR
healthcare

Beschreibung der Täter

16,000 files, include: Patients in the psychiatric service; Patients in the substance abuse treatment service; Staff medical records and internal correspondence. If you think you a...

Herkunft

brain cipheroflaherty-law.comIE

Beschreibung der Täter

32GB - materials related to adoptions, paternity, and DNA tests involving minors, as well as phone records and correspondence. If you think you are here by mistake, please contact ...

Herkunft

brain ciphersodali.comUS

Beschreibung der Täter

13,000 documents include: Annual Shareholders' Meetings—Swiss and German Clients. A complete list of issuer clients, their corporate documents, voting schedules, and voting result...

Herkunft

brain ciphersrsnodgrass.comUS
finanzen

Beschreibung der Täter

Total size - 100GB, 45,000 documents. Contents: Financial statements and pre-audit working papers; lists of bank employees; insider information on the financial condition of approx...

Herkunft

brain cipherprosomnus.comUS
healthcare

Beschreibung der Täter

Total size - 100GB, 78,000 files. Contents: Patients' PHI; Kaiser Permanente Patient-Partner Tracking Sheet; Non-public FDA regulatory files; .bak; .pst.; If you think you are here...

Herkunft

brain cipherolyortho.comUS
healthcare

Beschreibung der Täter

Total size - 105GB, 146,000 files. Contents: Patients' medical information (PHI under HIPAA); employee HR data; legally privileged materials; email; operational/technical documents...

Herkunft

brain ciphermvjllp.com—

Beschreibung der Täter

Big Data - total size 1.66TB, over 500k files. 413 court cases, internal work documents of the law firm and its clients, including privileged materials and PII/PHI. If you think yo...

Herkunft

brain cipherTrailerbridge.com—

Beschreibung der Täter

76200 files containing customer data: invoices, remittances, commercial relations with major chains (Walmart, Baxter, Cardinal); customs documents (declarations, EEI, Schedule B); ...

Herkunft

  • trailerbridge.com
  • Pfad auf der Leak-Seite: /n/Trailerbridge
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 12.10.2026
brain cipherhuntcompanies.comUS

Beschreibung der Täter

We have 80 GB of data. The data includes: military facilities, the military housing program, and information on service members and their families, including personal data on senio...

Herkunft

brain ciphertrailerbridge.comUS
transport

Beschreibung der Täter

76200 files containing customer data: invoices, remittances, commercial relations with major chains (Walmart, Baxter, Cardinal); customs documents (declarations, EEI, Schedule B); ...

Herkunft

brain ciphermccordclaims.comUS
finanzen

Beschreibung der Täter

78400 files containing medical authorizations, medical records about injured; insurance claims information; lists of authorized adjusters and attorneys; litigation registries (suit...

Herkunft

brain ciphergoriteway.comUS

Beschreibung der Täter

20.5 GB of data containing student incident records (25–26 Student Incident): PDF reports organized by student name and date (2.2025 – 5.2026) - descriptions of incidents with ...

Herkunft

brain ciphernortheastrehab.comUS
healthcare

Beschreibung der Täter

13k files containing patient records, clinical documentation, billing sheets, financial audits and IT department materials. If you think you are here by mistake, please contact us ...

Herkunft

brain ciphermulholland.comUS

Beschreibung der Täter

We have 110900 files with a total size of over 100 GB. The data includes: 1)Personal driver folders with confidential drugs test records and FMCSA inspection history; 2)Medical ...

Herkunft

brain cipherwildmanbg.comBG

Beschreibung der Täter

More than 350k files with a total size of over 80 GB. Contents: HR files (W-2/SSN/benefits/medical/disciplinary), bank reconciliations, treasury, accounting .bak files, Key Data, c...

Herkunft

brain ciphermaxwell-group.comGB

Beschreibung der Täter

We have over 115 GB of data — 150k files and documents containing: Complete corporate financial statements, budgets, and forecasts; Bank accounts and reconciliations (Truist);...

Herkunft

brain cipherlatitudesubro.comBR

Beschreibung der Täter

We have approximately 50 GB of data containing insurance claim files, medical data, client NDA/SA documents, W-9, ACH details and amounts, SOC reports, KPI, dashboards, budgets, an...

Herkunft

brain ciphergoldstarfinancial.comUS
finanzen

Beschreibung der Täter

We have approximately 10,300 (10.3k) documents from this company, with a total size of over 10.5 GB. Contents: Lead Sheets; Credit Reports; Tax Documents; Income Documents; Documen...

Herkunft

brain cipherhoyletanner.comGB

Beschreibung der Täter

We have 33,500 (33.5k) files, the contents of which include: Contracts and agreements; Commercial proposals; Invoices; Customer database; HR ; W-9 tax forms; ACH/banking documents;...

Herkunft

brain cipheraecom.comUS

Beschreibung der Täter

We've obtained 670 GB of data that most likely belongs to a Fortune 500 company. Stay tuned for more details — it's going to be interesting. If you think you are here by mistake,...

Herkunft

brain cipherxpera.caCA

Beschreibung der Täter

We have 20 GB of data belonging to this company. The data contains information such as employees' SINs, bank account details, salaries, addresses, dates of birth, RRSP/TFSA informa...

Herkunft

brain cipherahadandco.comAE

Beschreibung der Täter

We have about 405,000(405k) documents and files of your company, with a total size of over 300 GB. This data contains a significant amount of banking information, as well as the pe...

Herkunft

brain ciphersago.com—

Beschreibung der Täter

We have approximately 56,000 (56k) documents and files belonging to your company, including data on business relationships with more than 800 clients; data on research participants...

Herkunft

brain ciphercrmeyer.comDE

Beschreibung der Täter

We have about 275,000(275k) documents and files of your company, with a total size of over 330 GB. The data includes a customer database (~250 customers) — the largest ones are:...

Herkunft

brain cipherccsperfusion.comUS
healthcare

Beschreibung der Täter

We have approximately 306,000 (306k) documents and files belonging to your company, with a total size of over 200 GB. 160k files containing complete employee personnel files; 75k f...

Herkunft

brain ciphericot.esES

Beschreibung der Täter

If you use this hosting service, we have some bad news for you. We'll soon be publishing more than 200 database backups that belong to you. Demo download: h4zmek6bf3lebauy7dtyxmui6...

Herkunft

brain cipheraeiconsultants.comUS

Beschreibung der Täter

We have about 35,000(35k) documents and files of your company, with a total size of over 55 GB. The data includes: Personal Data, Real Estate Data, Internal Security/HR, Infrastruc...

Herkunft

brain ciphersyc.esES

Beschreibung der Täter

We have about 57,000(57k) documents and files of your company, with a total size of over 40 GB. Contents: Personal data of thousands of candidates for top positions; Data on the fi...

Herkunft

brain cipherAdviesbureau De Beuckelaer BVNL

Beschreibung der Täter

We have about 415,000(415k) documents and files of your company, with a total size of over 150 GB. Virtually all data falls under the protected category: 1) Financial data for more...

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.