Ransomware group profile · #199 by claimed victims

Samsam ransomware

Samsam is a ransomware operation tracked by VULONE since September 2026. Its leak site has named 12 victims since March 2016. The group most often targets Healthcare, Government & Defense, Education.

Defunct First seen Sep 2026

12Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

2Countries hit

0Leak-site URLs tracked

28 Sep 2018Latest claim recorded

Victimology

Who Samsam claims to have breached, from 12 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare4

Government & Defense4

Education2

Transportation2

Top countries

United States11

Canada1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Port of San Diego (Harbor and PD)	Transportation	US	28 Sep 2018
LabCorp	Healthcare	US	14 Jul 2018
Atlanta (and Atlanta PD)	Government & Defense	US	22 Mar 2018
Mississippi Valley State University	Education	US	1 Mar 2018
Colorado Department of Transportation (CDOT)	Transportation	US	21 Feb 2018
Allscripts Healthcare Solutions, Inc. allscripts healthcare solutions, inc.	Healthcare	US	18 Jan 2018
Hancock Health	Healthcare	US	11 Jan 2018
City of Farmington	Government & Defense	US	3 Jan 2018
Montgomery County (Alabama)	Government & Defense	US	18 Sep 2017
City of Newark	Government & Defense	US	25 Apr 2017
University of Calgary	Education	CA	28 May 2016
MedStar Health Baltimore	Healthcare	US	28 Mar 2016

All 12 Samsam victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Samsam is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Samsam ransomware still active?

Samsam is tracked as defunct. The most recent leak-site claim VULONE recorded is dated 28 September 2018.

How many victims has Samsam claimed?

VULONE has recorded 12 leak-site victim claims attributed to Samsam since March 2016, across 2 countries and 4 sectors.

Which industries does Samsam target?

The sectors most often named on the Samsam leak site are Healthcare, Government & Defense, Education.

Which countries are most affected by Samsam?

Most Samsam victims recorded by VULONE are located in United States, Canada.

Where does VULONE get Samsam victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].