Ransomware group profile · #30 by claimed victims

Ransomhouse ransomware

RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor "Jolly Scorpius," targeting over 120 organizations across healthcare, finance, transportation, and government, recently upgrading to a multi-layered dual-key encryption architecture.

Active First seen Jun 2021

217Victims claimed on leak sites

5Victims in the last 30 days

18Victims in the last 90 days

50Countries hit

191Leak-site URLs tracked, 12 online

30 Oct 2026Latest claim recorded

Victimology

Who Ransomhouse claims to have breached, from 217 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing40

Professional Services36

Healthcare27

Government & Defense22

Technology21

Financial Services16

Energy & Utilities12

Retail & E-Commerce11

Top countries

United States44

United Kingdom10

China10

Spain8

Japan8

Italy8

Brazil6

India5

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Phillips Nizer phillipsnizer.com	Professional Services	US	30 Oct 2026
[DISCLOSED]Terca	-	-	13 Oct 2026
[DISCLOSED]Hospital Hermilio Valdizán	-	-	13 Oct 2026
Excess Baggage excess-baggage.com	Transportation	GB	13 Oct 2026
PT Indo Tambangraya Megah itmg.co.id	Energy & Utilities	ID	2 Oct 2026
Hospital Hermilio Valdizán hhv.gob.pe	Healthcare	PE	1 Oct 2026
Terca terca.com.br	Other	BR	1 Oct 2026
Pertamina pertamina.com	Energy & Utilities	ID	17 Sep 2026
Namibian Defence Force mod.gov.na	Government & Defense	NA	16 Sep 2026
[DISCLOSED] California School Employees Association	-	-	15 Sep 2026
California School Employees Association csea.com	Education	US	10 Sep 2026
REXT Holdings Co., Ltd. rext.jp	Other	JP	1 Sep 2026

All 217 Ransomhouse victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Ransomhouse is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Ransomhouse ransomware still active?

Ransomhouse is tracked as active. The most recent leak-site claim VULONE recorded is dated 30 October 2026. 5 victims were claimed in the last 30 days.

How many victims has Ransomhouse claimed?

VULONE has recorded 217 leak-site victim claims attributed to Ransomhouse since June 2021, across 50 countries and 13 sectors.

Which industries does Ransomhouse target?

The sectors most often named on the Ransomhouse leak site are Manufacturing, Professional Services, Healthcare.

Which countries are most affected by Ransomhouse?

Most Ransomhouse victims recorded by VULONE are located in United States, United Kingdom, China.

Where does VULONE get Ransomhouse victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.