SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

chaos

17 Einträge insgesamtRaaS

Zeitraum: 25.08.2026 – 09.10.2026

Chaos is a rapidly evolving Ransomware-as-a-Service (RaaS) group first observed in early 2025. It is considered distinct and unaffiliated with the Chaos Ransomware Builder that originated around 2021. Known for highly aggressive double-extortion operations, Chaos targets organizations across multiple platforms—Windows, ESXi, Linux, and NAS—with fast, configurable encryption mechanisms and optional partial-file targeting for stealth. Attackers gain access through vulnerabilities, phishing, or brokered credentials, then encrypt files while threatening to leak or destroy stolen data. Notable incidents include the breach of Optima Tax Relief, in which the group exfiltrated 69 GB of sensitive data before encrypting systems.

Veröffentlichungskanäle

  • Leak-Seite · CHAOS · zuletzt nicht erreichbar
  • Dateiablage · Index of / · zuletzt nicht erreichbar
  • Dateiablage · Index of /goosehead/ · zuletzt erreichbar
  • Dateiablage · zuletzt nicht erreichbar
  • Dateiablage · 403 Forbidden · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Meldungen, die den Gruppennamen neben einem Fachbegriff nennen. Kein Maß für die Schwere eines Vorfalls und kein Beleg, dass ein bestimmtes Opfer in der Presse stand.

Neueste Einträge

Filter zurücksetzen
chaosastranahealth.comUS
healthcare

Beschreibung der Täter

The company's management decided to pull out of the deal with us in order to save money. The data and diagnoses of millions of patients have been published in their entirety. The total data volume is 1,500 GB. Astrana Health, Inc. is a physician-centric, technology-powered healthcare company headqu…

Herkunft

chaosparkdental.comGB
healthcare

Beschreibung der Täter

To the Management of Park Dental: Time is running out. Our previous attempts to establish a constructive dialogue regarding the security breach have been met with silence. If the management of Park Dental fails to get in touch with our team within the next 24 hours, we will proceed with the full p…

Herkunft

chaosadvantech.com—

Beschreibung der Täter

We are publishing 5% of the total data because the company's management is ignoring the situation and has not contacted us. The company's management has exactly 48 hours to contact us; otherwise, the entire dataset will be published.

Herkunft

  • advantech.com
  • Pfad auf der Leak-Seite: /Pfa5mOakuACFbqhsUgrEzO57i8E7T5gR/advantech-com
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 29.09.2026
chaoscarolinaasthma.comUS
healthcare

Beschreibung der Täter

Company management has 24 hours to reach an agreement with us. Otherwise, 290 GB of data will be disclosed, such as “Other Patient Forms” (name, date of birth, MRN, Social Security number, phone number, address… and so on) Administrative and financial matters, procurement, business services,…

Herkunft

chaosexpresspros.com—

Beschreibung der Täter

Express Employment Professionals — Data Breach Notification & Public Disclosure We have officially initiated the public release phase regarding expresspros.com. Despite our direct attempts to establish communication, company leadership and their representatives have chosen a strategy of silence…

Herkunft

  • expresspros.com
  • Pfad auf der Leak-Seite: /mFUAsV9Nk0iS2j0zwsyTIswYOdzplru9/expresspros-com
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 17.09.2026
chaosglasfloss.com—

Beschreibung der Täter

DATA LEAK NOTICE: GLASFLOSS (glasfloss.com) A comprehensive data breach has exposed 402 GB of confidential corporate, financial, and employee records from Glasfloss. The compromised database contains internal documentation across multiple departments: • Accounting & Finance: Contracts, ESOP rec…

Herkunft

chaossteelhausinc.com—

Beschreibung der Täter

Steelhaus boldly drives the market with innovative energy solutions; fusing practical, field proven experience, adaptable engineering, integrated manufacturing, and uncompromising safety with relentless delivery of unwavering customer service

Herkunft

chaosmankatoclinic.comUS

Beschreibung der Täter

The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea…

Herkunft

chaosartiflexmfg.com—

Beschreibung der Täter

ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica…

Herkunft

chaoscopeplastics.comUS

Beschreibung der Täter

Cope Plastics is a leading U.S. distributor and fabricator of performance plastics, serving industrial and commercial customers since 1946. From our headquarters in Alton, Illinois and through multiple branch locations, we support clients across countless sectorsheavy equipment, transportation, aero…

Herkunft

chaosevergenbio.com—

Beschreibung der Täter

Evergen is a leading Contract Development and Manufacturing Organization (CDMO) specializing in biomaterial solutions for regenerative medicine. We work closely with OEM partners to deliver customized biomaterial solutions that meet specific clinical needs

Herkunft

chaoscorematerials.com—

Beschreibung der Täter

Core Materials (corematerials.com) — Countdown to Publication Management at Core Materials has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are m…

Herkunft

chaosmacallister.com—

Beschreibung der Täter

MacAllister (macallister.com) — Countdown to Publication Management at MacAllister has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving fo…

Herkunft

chaossingleton.comGB

Beschreibung der Täter

Founded in 1986, Singleton Reynolds is a law firm. They are headquartered in Vancouver, British Columbia.

Herkunft

chaosmswalker.com—

Beschreibung der Täter

MS Walker (mswalker.com) – Countdown to Publication Management at MS Walker has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving forward o…

Herkunft

chaosparkderochie.com—

Beschreibung der Täter

Park de Rochie (parkderochie.com) – Countdown to Publication Management at Park de Rochie has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are mo…

Herkunft

chaoscopcp.comUS

Beschreibung der Täter

Central Ohio Primary Care (copcp.com) – Countdown to Publication Management at Central Ohio Primary Care has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to en…

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.