Skip to main content
Darkfield

leakeddata

active · posted 6 days ago

#311 of 402 tracked operators by disclosures · first seen Oct 14, 2026

Watch this operatorCSVAPILineage
Disclosures3none in the last 7 daysVelocity · month over monthunknownmonthly series not yet builtMirrors reachableunknownno onion location on record
Corroborationunknownnot recorded for this operator yet

Infrastructure

0 known onion locations from the catalogs
  • Checking mirrors

Recent disclosures

all, filterable →
  • Loading recent disclosures
How we know this: victim rows from our Tor crawl and the RansomLook tracker, de-duplicated by canonical operator and name; "active" means a post in the last 60 days; mirror status from our own curl over Tor; aliases and references from MISP galaxy; tradecraft from ATT&CK STIX. Operator claims are claims.Updated 6 days ago

Get alerted the next time leakeddata posts a victim.

Add leakeddata to your watchlist: an alert within the sync cadence on any new leakeddata leak-site post, Telegram callout or affiliate-rebrand inference.

Operator dossier

leakeddata is a ransomware operator currently active on public leak sites. Darkfield has indexed 3 public victims claimed by this operator between October 14, 2026 and October 9, 2026.

Recent disclosures by leakeddata

All 3 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for leakeddata →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated catalogues (RansomLook, deepdarkCTI, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.