Threat Watch · Jun 28, 2026
ℹ️ Data source: RansomLook
api/posts?days=1. The latestdiscoveredvalue returned by this pull is 2026-06-26T15:57Z; the feed has not advanced to 06-27/06-28 (the public RansomLook endpoint often runs 1-2 days behind). The tables below therefore overlap heavily with the 06-27 edition and should be treated as a continuation of the same batch of leak-site posts, with limited new signal.
Overview
- Total new posts: 20
- Groups involved: 15(payload ×3, chaos / inc ransom / nova 2 each, the rest 1 each)
- Watchlist hits: 3(akira ×1, inc ransom ×2)
Watchlist Hits (read these first)
| Group | Victim | Sector | Geo | Hit | Discovered |
|---|---|---|---|---|---|
| akira | Precise Forms | manufacturing (construction forms) | US | group:akira | 2026-06-26T15:57 |
| inc ransom | GSP Crop Science Pvt | agriculture/chemical | IN | group:inc | 2026-06-26T03:52 |
| inc ransom | Life Bridges | healthcare/non-profit | — | group:inc | 2026-06-26T03:52 |
All New Posts
| Group | Victim | Sector | Geo | Discovered |
|---|---|---|---|---|
| insomnia | (title masked) | — | — | 2026-06-25T17:49 |
| chaos | roofdepot.com | retail/construction | US | 2026-06-25T18:48 |
| interlock | Clearview Eye Centre | healthcare (ophthalmology) | — | 2026-06-25T18:48 |
| anubis | Nachlass Nord | services | DE | 2026-06-25T19:21 |
| leaknet | MagMutual (7.3M records) | insurance (cyber insurance) | US | 2026-06-25T21:48 |
| the gentlemen | Atlas Elektronik | defense/naval electronics | DE | 2026-06-25T22:42 |
| krybit | politur.gob.do | government (police) | DO | 2026-06-25T22:50 |
| nightspire | Grupo Riquelme | retail/distribution | ES/MX | 2026-06-25T23:50 |
| inc ransom | GSP Crop Science Pvt | agriculture/chemical | IN | 2026-06-26T03:52 |
| inc ransom | Life Bridges | healthcare/non-profit | — | 2026-06-26T03:52 |
| prinz eugen | (new leak site launch announcement) | — | — | 2026-06-26T05:53 |
| cmd organization | Kohinoor Mills | manufacturing (textiles) | PK | 2026-06-26T09:56 |
| nova | vslmarine | maritime/logistics | — | 2026-06-26T09:56 |
| ailock | Hokua | services | — | 2026-06-26T11:57 |
| chaos | ingerman.com | real estate | US | 2026-06-26T11:57 |
| payload | Software Arge | technology | TR | 2026-06-26T12:59 |
| payload | Clínica La Sabana | healthcare (hospital) | CO | 2026-06-26T12:59 |
Anomalies / Trend Notes
- Feed stalled: for two consecutive briefing days (06-27, 06-28) RansomLook
days=1has returned the same 20 entries, with the latest still frozen at 06-26T15:57. Worth determining whether this is endpoint lag or a genuine lull on the leak sites themselves; if the next edition still shows no movement, fall back to the RSS feed or cross-check against ransomware.live. - payloadposted 3 victims within a single minute (Software Arge / Clínica La Sabana / Mosaic Partners), apparently a bulk release of a backlogged list.
- Sensitive targets(no automatic hit; manually annotated):
leaknet → MagMutual— a cyber insurance carrier, with a claimed 7.3M records; an ironic case of an insurer its own coverage could not save.the gentlemen → Atlas Elektronik— German naval/defence electronics, a defence supply chain risk.- Healthcare concentration: interlock → Clearview Eye Centre, payload → Clínica La Sabana.
- Government/emergency: krybit → politur.gob.do (Dominican police), nova → NSW Rural Fire Service (Australian rural fire service).