CYBERSECURITYTRACKER
Incidents

Worldleaks

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

extortion180 leak-site claims, all timeLatest observed leak-site post 2026-07-22

Portable threat brief

Worldleaks

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor
Worldleaks
Kind
extortion
Actor record created
2026-07-02
Latest observed
2026-07-22
Leak-site claims
180
Catalogued techniques
0

Scope

Tracked sectors
Healthcare, Manufacturing, Legal, Education, Retail
Claim records
2025-05-12 to 2026-07-22

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsHealthcareManufacturingLegalEducationRetail
Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records
First observed Latest observed
Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand
180 on this site
View all on Breaches →
Leak-site claim activity

Claims per month, 2025-05 to 2026-07. Peak 25 in 2025-07.

2025-052026-07
Show monthly counts as a table
MonthClaims
2025-059
2025-0622
2025-0725
2025-0814
2025-0913
2025-109
2025-1110
2025-1213
2026-015
2026-026
2026-0316
2026-0412
2026-056
2026-0612
2026-078

0 additional claims without a disclosure date

Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (Terms of use: credit and link required).

Glossary