Ransomware group profile · #142 by claimed victims

Kelvinsecurity ransomware

KelvinSecurity is a financially motivated hacking group active since at least 2015, primarily engaged in stealing and selling databases from telecommunications, healthcare, and political organizations worldwide, with notable breaches including Vodafone Italia and Frost & Sullivan; the group's leader was arrested by Spanish police.

Active First seen Apr 2022

26Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

0Countries hit

0Leak-site URLs tracked

24 May 2022Latest claim recorded

Victimology

Who Kelvinsecurity claims to have breached, from 26 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Government & Defense5

Technology5

Financial Services3

Agriculture and Food Production2

Manufacturing2

Professional Services2

Energy & Utilities2

Hospitality1

Top countries

No country data yet.

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
TRANSCONTRACT	Transportation	—	24 May 2022
Mansfield Energy	Energy & Utilities	—	24 May 2022
Channel Navigator business intelligence IT	Technology	—	13 May 2022
Next Leak On Hold	Not Found	—	6 May 2022
PTC Industries	Manufacturing	—	6 May 2022
Municipality of Posadas	Government & Defense	—	3 May 2022
bfclcoin	Technology	—	3 May 2022
Instance IT Solutions India	Technology	—	3 May 2022
Waiting for next leak	Not Found	—	25 Apr 2022
NATION Costa Rica	Government & Defense	—	25 Apr 2022
PT Pertamina Gas	Energy & Utilities	—	22 Apr 2022
BMW CHILE	Manufacturing	—	1 Apr 2022

All 26 Kelvinsecurity victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Kelvinsecurity is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Kelvinsecurity ransomware still active?

Kelvinsecurity is tracked as active. The most recent leak-site claim VULONE recorded is dated 24 May 2022.

How many victims has Kelvinsecurity claimed?

VULONE has recorded 26 leak-site victim claims attributed to Kelvinsecurity since April 2022, across 0 countries and 10 sectors.

Which industries does Kelvinsecurity target?

The sectors most often named on the Kelvinsecurity leak site are Government & Defense, Technology, Financial Services.

Which countries are most affected by Kelvinsecurity?

Country data for Kelvinsecurity victims is not yet available.

Where does VULONE get Kelvinsecurity victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].