Ransomware group profile · #89 by claimed victims

Ransomed ransomware

RansomedVC was a short-lived extortion group active from August to November 2023 that claimed high-profile victims including Sony, innovating by threatening GDPR regulatory fines as an additional extortion lever; it briefly operated as a RaaS before shutting down in an apparent exit scam following reported arrests of six members.

Active First seen Aug 2023

68Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

10Countries hit

4Leak-site URLs tracked, 0 online

30 Oct 2023Latest claim recorded

Victimology

Who Ransomed claims to have breached, from 68 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Retail & E-Commerce17

Technology14

Financial Services7

Professional Services5

Other4

Healthcare4

Manufacturing3

Energy & Utilities2

Top countries

Bulgaria19

Japan3

Brazil3

United Kingdom2

AX1

Iceland1

St Vincent1

United States1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
RANSOMEDVC is for sale	Other	-	30 Oct 2023
Ransomedvc Launches A forum	Other	-	22 Oct 2023
We Hire Pentesters(5BTC Payout) ransomed.vc	Other	VC	20 Oct 2023
Ransomedvc Pentest Services!	Professional Services	-	16 Oct 2023
RE : Clarification	Not Found	-	16 Oct 2023
Rob Lee Evidence : Sneak Peek	Not Found	-	16 Oct 2023
Colonial Pipeline Company colonialpipeline.com	Energy & Utilities	-	15 Oct 2023
Accenture Breach Evidence & Debunking Rob Lee’s Lies accenture.com	Professional Services	-	15 Oct 2023
webpag.com.br database leaked webpag.com.br database leaked	Retail & E-Commerce	-	15 Oct 2023
Metroclub.org metroclub.org	Retail & E-Commerce	-	13 Oct 2023
Optimity UK optimity.co.uk	Technology	GB	13 Oct 2023
Baumit Bulgaria baumit.bg	Manufacturing	BG	13 Oct 2023

All 68 Ransomed victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Ransomed is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Ransomed ransomware still active?

Ransomed is tracked as active. The most recent leak-site claim VULONE recorded is dated 30 October 2023.

How many victims has Ransomed claimed?

VULONE has recorded 68 leak-site victim claims attributed to Ransomed since August 2023, across 10 countries and 12 sectors.

Which industries does Ransomed target?

The sectors most often named on the Ransomed leak site are Retail & E-Commerce, Technology, Financial Services.

Which countries are most affected by Ransomed?

Most Ransomed victims recorded by VULONE are located in Bulgaria, Japan, Brazil.

Where does VULONE get Ransomed victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 21 October 2026. Questions or corrections: research@vulone.com.