Threat Watch · Aug 13, 2026
112 disclosures monitored over the past 36-hour window, from 17 active groups (source: RansomLook).
Focus: Clop Launches a Mass Batch of Data-Theft Disclosures
On August 12, Clop posted 42 new victim disclosures on its data leak site in a single burst, including a number of well-known enterprises and brands: Shell (89GB of engineering drawings and facility test reports), GE (391GB of software backups and system files), Fiserv (874GB of project files), Philips (13.5GB of drawings), Toast (215GB of project files and database backups), Largan, Aldo Group, Mammut, Starkey, and others. Annual revenue figures listed in the disclosures range from hundreds of millions to trillions of dollars, spanning industrial manufacturing, fintech, consumer goods, energy, and other sectors. The pattern of releasing 42 victims on a single day resembles the cadence of past bulk extortion disclosures following supply chain attacks such as Oracle EBS and MOVEit, but this batch does not spell out the intrusion method — watch for official responses and follow-up technical analysis.
Emerging / Active Group: crpx0
A previously little-documented group, "crpx0," posted 41 disclosures in the same window. Targets are concentrated in Turkey (Doğan Holding, Anadolu Sigorta, defense electronics maker ASELSAN, TOGG, and banks including Kuveyt Turk and Finansbank, based in Istanbul, Ankara, and elsewhere) and among US small and mid-sized businesses (law firms, dental practices, real estate, cloud service providers). Data volumes range from 0.2GB to 700GB, with most marked "Status: Leaked," suggesting exfiltration is complete and the data has been published — and all operated through the same .onion site.
Other Active Groups
- inc ransom(5 disclosures): several US small and mid-sized businesses plus Australia's BEDC.COM.AU
- the gentlemen(3): Italian environmental firm IPS, Swiss real estate trust Gfeller Treuhand, US security equipment supplier Safeware
- leakeddata(3): US law firm Riker Danzig Scherer Hyland & Perretti, among others
- qilin(3): retail, labor unions, and others
- krybit / ailock / nightspire / dragonforce / akira / kairos / panzer / payload / genesis / space bears / ransomhouse: 1–3 disclosures each, spanning retail, automotive service and repair, investment holding, and other industries
Targets Worth Watching
- GB Group S.A(one of Haiti's largest private industrial and trading conglomerates, claimed by dragonforce)
- Zara Investment Holding(large Jordanian investment group in hospitality and tourism, claimed by payload)
- Doğan Holding / ASELSAN / Anadolu Sigorta(large Turkish media, defense electronics, and insurance firms, claimed by crpx0)