Incidents

Interlock

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware175 leak-site claims, all timeLatest observed leak-site post 2026-11-04

ORKL search ↗

Portable threat brief

Interlock

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor: Interlock
Kind: ransomware
Actor record created: 2026-07-07
Latest observed: 2026-11-04
Leak-site claims: 175
Catalogued techniques: 0

Scope

Tracked sectors: Education, Healthcare, Manufacturing, Government, Construction & Engineering
Claim records: 2024-10-14 to 2026-11-04
News stories naming this group: 2025-07-14 to 2026-10-29

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsEducationHealthcareManufacturingGovernmentConstruction & Engineering

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2024-10-14Latest observed 2026-11-04
News stories naming this group: First observed 2025-07-14Latest observed 2026-10-29

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

175 on this site

Elmcrest Children's Center, IncHealthcare2026-11-04source ↗
Indiana Area School DistrictEducation2026-11-02source ↗
Jerome School DistrictEducation2026-11-02source ↗
Highland Mountain Bike ParkHospitality2026-11-01source ↗
Assiniboine Dental GroupHealthcare2026-11-01source ↗
Meadows Valley School DistrictEducation2026-10-31source ↗
Ridgway High SchoolEducation2026-10-31source ↗
Southwest Orthopedic & Reconstructive SpecialistsHealthcare2026-10-29source ↗
Madison HondaAutomotive2026-10-23source ↗
Custom Floors UnlimitedConstruction & Engineering2026-10-23source ↗

View all on Breaches →

Leak-site claim activity

Claims per month, 2024-10 to 2026-11. Peak 16 in 2026-10.

2024-102026-11

Show monthly counts as a table

Month	Claims
2024-10	6
2024-11	2
2024-12	6
2025-01	0
2025-02	3
2025-03	6
2025-04	7
2025-05	7
2025-06	14
2025-07	4
2025-08	12
2025-09	0
2025-10	6
2025-11	6
2025-12	8
2026-01	10
2026-02	8
2026-03	8
2026-04	8
2026-05	10
2026-06	6
2026-07	7
2026-08	4
2026-09	6
2026-10	16
2026-11	5

0 additional claims without a disclosure date

News stories naming this group

7 on this site

2026-10-29threat intelIR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-09-07breaches incidentsJune 2026 Healthcare Data Breach Report
2026-07-24ransomwareRansomware is the Scoreboard
2026-04-13vulnerabilitiesMarch 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Day
2025-09-10ransomwareEmerging Threat Actor: Interlock Ransomware
2025-07-15ransomwareHow Interlock Ransomware Gang’s New RAT Slips Through the Cracks
2025-07-14ransomwareKongTuke FileFix Leads to New Interlock RAT Variant

Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (Terms of use: credit and link required).