Threat Watch · Aug 9, 2026

RansomLook logged 30 victim disclosures in the past 36 hours, involving 7 active groups.

Group Activity

qilin was the most active group this cycle, disclosing 8 attacks with targets spanning Europe, Latin America, and Southeast Asia: pm-energy Die Solarexperten (German solar company), Harplast SRL, Price Shoes (Mexican retailer), Naval Interior Team, Phithan Phanich, Grupo Diestra, Université Libre de Bruxelles (Belgian university), Service d'usinage 9002.

leakeddata disclosed a concentrated batch of 11 compromised US law firms: Rutan & Tucker, Floyd Skeren Manukian Langevin, Ropers Majeski, Farella Braun + Martel, Sandberg Phoenix, Porter Wright, Marshall Dennehey, Barclay Damon, Fox Rothschild, Mayer Brown, Moses & Singer — the legal sector appears to be this group's concentrated target in the current wave.

coinbase cartel disclosed 4 attacks: CEN and Cenelec (European standardization organizations), MIM Fertility, M. B. Kahn Construction Co., Xs Cad.

Other single disclosures: krybit claimed an attack on Italy's studiotibaldi.it; sovcali claimed Lucidmotors; panzer claimed Nigerian media outlet Daily Trust; inc ransom claimed the Louisville Bar Association (Louisville, US).

Worth Watching

The legal services sector took concentrated losses this cycle — leakeddata disclosed 11 US law firm victims in one batch, a scale clearly out of line with routine single disclosures. The European standardization bodies CEN/Cenelec were allegedly compromised by coinbase cartel; the downstream impact (standards-development processes, member-organization data) warrants continued tracking of follow-up disclosures for confirmation.