« All threats

Ransomware group

M3rx

Victims in the last 90 days19

Most affected countries

  1. United States7
  2. United Kingdom2
  3. Costa Rica1
  4. Germany1
  5. Spain1
  6. Australia1
  7. Ireland1
  8. Pakistan1

Most affected sectors

  1. Technology5
  2. Professional services4
  3. Manufacturing3
  4. Transport & logistics2
  5. Legal1
  6. Real estate1
  7. Hospitality & tourism1
  8. Telecommunications1

Recent victims

OrganisationCountrySectorClaimedStatus
NTENSE GroupPolandTechnology9/29/2026◌ Claimed (unverified)
CPA CBUnited StatesProfessional services9/29/2026◌ Claimed (unverified)
Otero Geeza LawUnited StatesLegal9/29/2026◌ Claimed (unverified)
Soma SoluçõesBrazilTechnology9/29/2026◌ Claimed (unverified)
Noon Sugar Mills LimitedPakistanAgriculture & food9/29/2026◌ Claimed (unverified)
Interconnect Computer Cabling Services, Inc.United StatesTelecommunications9/29/2026◌ Claimed (unverified)
Cipher SystemsUnited StatesTechnology9/26/2026◌ Claimed (unverified)
Lindner GroupGermanyManufacturing8/29/2026◌ Claimed (unverified)
TecnoabiSpainTechnology8/14/2026◌ Claimed (unverified)
VHS HydraulicsUnited KingdomManufacturing7/26/2026◌ Claimed (unverified)
CreateInforPortugalProfessional services7/26/2026◌ Claimed (unverified)
Service by PremierUnited StatesProfessional services7/26/2026◌ Claimed (unverified)
AusProofAustraliaManufacturing7/24/2026◌ Claimed (unverified)
UB Freight—Transport & logistics7/22/2026◌ Claimed (unverified)
SuppCenter Global ServicesCosta RicaTechnology7/17/2026◌ Claimed (unverified)
Arambol LLPUnited KingdomReal estate7/17/2026◌ Claimed (unverified)
EclectiveIrelandHospitality & tourism7/12/2026◌ Claimed (unverified)
FORECON Inc.United StatesProfessional services7/12/2026◌ Claimed (unverified)
WRT World EnterprisesUnited StatesTransport & logistics7/12/2026◌ Claimed (unverified)

Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.

Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.