« All threats

Ransomware group

Space Bears

Victims in the last 90 days22

Most affected countries

  1. United States6
  2. Italy5
  3. Cameroon1
  4. Colombia1
  5. Czechia1
  6. Germany1
  7. Brazil1
  8. South Korea1

Most affected sectors

  1. Technology5
  2. Retail5
  3. Manufacturing3
  4. Agriculture & food2
  5. Professional services2
  6. Telecommunications1
  7. Real estate1
  8. Healthcare1

Recent victims

OrganisationCountrySectorClaimedStatus
Tomix / Grupo JOPERPortugalAgriculture & food9/23/2026◌ Claimed (unverified)
D-MAX Engineering, Inc.United StatesProfessional services9/5/2026◌ Claimed (unverified)
Sports EndeavorsUnited StatesRetail9/4/2026◌ Claimed (unverified)
Studio Oculistico CiraciItalyHealthcare9/3/2026◌ Claimed (unverified)
Schwartz, Giannini, Lantsberger & AdamsonUnited StatesProfessional services9/3/2026◌ Claimed (unverified)
Holzmarkt ChemnitzGermanyRetail8/22/2026◌ Claimed (unverified)
Freelom.net s.r.o.CzechiaTelecommunications8/22/2026◌ Claimed (unverified)
SEARS (Grupo Sanborns)MexicoRetail8/15/2026◌ Claimed (unverified)
Basso Fedele & Figli S.r.l.ItalyAgriculture & food8/12/2026◌ Claimed (unverified)
Elixi International SASwitzerlandPharma & chemicals8/10/2026◌ Claimed (unverified)
Hitech Distribuzione InformaticaItalyTechnology8/7/2026◌ Claimed (unverified)
PontoBR SistemasBrazilTechnology8/5/2026◌ Claimed (unverified)
StellarRAD SystemsUnited StatesTechnology7/29/2026◌ Claimed (unverified)
DoAllTechSouth KoreaTechnology7/22/2026◌ Claimed (unverified)
Anpra SASColombiaAutomotive7/22/2026◌ Claimed (unverified)
BiesSse GroupItalyManufacturing7/22/2026◌ Claimed (unverified)
FITcrunchUnited StatesRetail7/16/2026◌ Claimed (unverified)
TurbosoftCameroonTechnology7/13/2026◌ Claimed (unverified)
Techpol-SystemPolandManufacturing7/13/2026◌ Claimed (unverified)
BiessseItalyManufacturing7/8/2026◌ Claimed (unverified)
FitcrunchUnited StatesRetail7/7/2026◌ Claimed (unverified)
BlenheimUnited KingdomReal estate7/6/2026◌ Claimed (unverified)

Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.

Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.