Threat Watch · Jun 19, 2026
Data window: RansomLook
/api/posts?days=1, actually covering 2026-06-17T20:46 → 2026-06-18T14:45 UTC (real-time clock lags the report date; roughly an 18-hour window). The API returns onlygroup_name / post_title / discovered, with no sector/geo fields — sector/geography is inferred manually from victim names.
Overview
- Total new posts: 67
- Groups involved: 11
- Watchlist hits: ~42(driven up mainly by lockbit5's massive bulk dump)
- Top 3 most active groups: lockbit5 (34) · the gentlemen (12) · safepay (5)
Watchlist Hits (read first)
| Group | Victim | Sector (inferred) | Geo | Hit |
|---|---|---|---|---|
| inc ransom | Horizon Family Medical Group | Healthcare | US | group:inc · sector:medical |
| shinyhunters | Amazon-owned OneMedical.com | Healthcare | US | sector:medical |
| shinyhunters | NAIC.org (National Association of Insurance Commissioners) | Finance/regulatory | US | sector:financial (editorial judgment) |
| inc ransom | neuwoges.de (housing) | Real estate | DE | group:inc |
| lockbit5 | delano.k12.mn.us | Education, K-12 | US | group:lockbit · geo:us |
| lockbit5 | saude.mt.gov.br | Healthcare/government | BR | group:lockbit |
| lockbit5 | eternal.hk | — | HK | group:lockbit · geo:hk |
| lockbit5 | comta.com.tw | — | TW | group:lockbit · geo:tw |
| lockbit5 | parkviewtaipei.com | Hospitality | TW (Taipei) | group:lockbit |
| akira | Apptricity (logistics/supply-chain software) | Logistics | US | group:akira |
| akira | Berg Lilly | Legal | US | group:akira |
| play | eurOptimum / Integrated Technologies / Greg Crosslin | Mixed | EU/US | group:play |
| ransomhouse | Prince George County | Government | US | sector:government (editorial judgment) |
Note: lockbit5 dumped 34 victims in a single batch, including multiple Asia-Pacific (.tw/.hk/.th/.jp) and Latin American (.br/.co/.mx/.hn) targets; the table above lists representative hits only.
All New Posts (aggregated by group)
| Group | Count | Representative victims |
|---|---|---|
| lockbit5 | 34 | majorcineplex.com, daikyonishikawa.co.jp, saude.mt.gov.br, delano.k12.mn.us, eternal.hk, comta.com.tw, elematic.com … |
| the gentlemen | 12 | SGS Malaysia, Al Khaja Holding, Cofaq, Sertrans, Yudu Technology, TERRIO Therapy Fitness … |
| safepay | 5 | harcourts.net, gut-heckenhof.de, zaunsysteme.de, brscappuccio.it, seinordovest.it |
| play | 3 | eurOptimum, Integrated Technologies, Greg Crosslin |
| lynx | 3 | wolfconstruction.net, eastersealsia.org, someco.com |
| inc ransom | 2 | Horizon Family Medical Group, neuwoges.de |
| shinyhunters | 2 | NAIC.org, Amazon-owned OneMedical.com |
| genesis | 2 | ABC of Indiana/Kentucky, United Personnel (Masis Staffing) |
| akira | 2 | Apptricity, Berg Lilly |
| lamashtu | 1 | Great Foods |
| ransomhouse | 1 | Prince George County |
Anomalies / Trend Notes
- lockbit5 massive bulk dump: 34 victims published at once within a single time slot (06-18 12:40–12:41 UTC), with highly dispersed geography (Asia-Pacific, Latin America, Europe, North America) — consistent with LockBit's usual "bulk-list old inventory" playbook after resurfacing; be wary of the data's authenticity and potential reuse.
- "the gentlemen" remains highly prolific(12 posts), extending yesterday's assessment of it as the second-most-active group by victim count; this batch includes SGS Malaysia and other well-known multinational testing/certification organizations.
- shinyhunters targets high-value victims: simultaneously claims NAIC.org(National Association of Insurance Commissioners) and Amazon-owned One Medical(healthcare), continuing its large-scale data-extortion trajectory.
- Healthcare in the crosshairs again: inc ransom (Horizon Family Medical) + shinyhunters (One Medical) + lockbit5 (saude.mt.gov.br) — multiple groups hit healthcare/health targets on the same day.
- New/rare group names: lamashtu, genesis, and lynx appear at low frequency; keep observing to determine whether any are rebrands.