Ransomware group profile · #111 by claimed victims

Donutleaks ransomware

Donut Leaks (D0nut) is a data-extortion group active since August 2022 that developed its own ransomware encryptor, linked to attacks on Greece's DESFA gas company and Continental, believed to be an affiliate of multiple RaaS operations who pivoted to running an independent extortion platform.

Active First seen Aug 2022

42Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

5Countries hit

6Leak-site URLs tracked, 0 online

24 Jul 2024Latest claim recorded

Victimology

Who Donutleaks claims to have breached, from 42 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services8

Healthcare6

Manufacturing5

Technology5

Hospitality3

Other3

Government & Defense2

Transportation1

Top countries

United States8

Spain1

Canada1

Italy1

Iran1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Jack "Designer" Sparrow. 1-sourcedesign.com	Professional Services	CA	24 Jul 2024
Industrial Bolsera industrialbolsera.com	Manufacturing	ES	24 Jul 2024
KickDown ESET company. No overpayments at 0% (renamed and update) kickdown eset company. no overpayments at 0% (renamed and update)	Technology	—	21 Jul 2024
ESET. PREMIUM. eset. premium.	Technology	—	20 Jul 2024
all-mode.com all-mode.com	Transportation	US	18 Jul 2024
labline.it labline.it	Healthcare	IT	17 Jul 2024
valleylandtitleco.com - UPD valleylandtitleco.com	Professional Services	US	15 Jul 2024
valleylandtitleco.com valleylandtitleco.com	Professional Services	US	3 Jul 2024
Patriot Machine	Manufacturing	US	19 May 2024
Pittsburgh’s Trusted Orthopaedic Surgeons gpoa.com	Healthcare	US	17 May 2024
Good Morning	Hospitality	US	5 Apr 2024
voidinteractive.net you are welcome in our chat voidinteractive.net	Technology	IR	14 Mar 2024

All 42 Donutleaks victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Donutleaks is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Donutleaks ransomware still active?

Donutleaks is tracked as active. The most recent leak-site claim VULONE recorded is dated 24 July 2024.

How many victims has Donutleaks claimed?

VULONE has recorded 42 leak-site victim claims attributed to Donutleaks since August 2022, across 5 countries and 11 sectors.

Which industries does Donutleaks target?

The sectors most often named on the Donutleaks leak site are Professional Services, Healthcare, Manufacturing.

Which countries are most affected by Donutleaks?

Most Donutleaks victims recorded by VULONE are located in United States, Spain, Canada.

Where does VULONE get Donutleaks victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].