RansomHub is a ransomware-as-a-service operation that emerged in February 2024. An August 2024 joint FBI, CISA, MS-ISAC and HHS advisory described its ransomware variant as formerly known as Cyclops and Knight and reported at least210victims across multiple critical infrastructure sectors. Affiliates used encryption and data theft for double extortion, with intrusion and exfiltration methods varying by affiliate. The advisory documented phishing, exploitation of known vulnerabilities and password spraying among observed access methods. In its account of events in spring2025, Sophos Counter Threat Unit described the RansomHub leak site going offline amid an apparent hostile takeover involving DragonForce; that assessment does not establish a confirmed merger or continuity of all operators and affiliates.
RansomHub listed the casino domain as an alleged victim. Original Comparitech reporting described an unspecified payment amount and a one-month deadline. Tracker discovery March31 is not original publication; its exact order relative to the council president’s March31 acknowledgment remains unknown. The claim does not verify encryption, theft, payment or causal responsibility.
Ransomware.live indexes a RansomHub victim listing for www.townofbourne.com, observed Feb.27,2025, at22:07:29.260463UTC. The old municipal domain now redirects to bourne-ma.gov. The tracker provides no attack date, original actor-post URL, verified original publication date, data quantity or ransom demand; its municipal description is explicitly AI-generated background. The town independently acknowledged suspicious activity, and its county IT provider later called the January event ransomware, but neither reviewed primary account identifies RansomHub as responsible. The county’s qualified finding of no confirmed data loss must be distinguished from the town’s potentially affected consumer notifications and the state’s625-Massachusetts-resident filing. The listing alone does not establish encryption, data theft, publication or payment; the town administrator reported no ransom paid.
A RansomHub-attributed tracker listing names the city’s exact domain, www.cityoftarrant.com. Comparitech’s Feb. 17 report describes the group’s allegation that it stole 28 gigabytes and displayed purported police and traffic records. The city had not confirmed RansomHub’s claim. The separately acknowledged ransomware attack and ransom demand do not verify this group’s responsibility, the alleged theft volume or the authenticity of the displayed records. The tracker discovery time is not the original claim publication time, which remains unknown.
RansomHub listed the district domain in a claim observed Feb. 9, 2025. Comparitech reported the listing and an allegation of 4 terabytes of stolen data. Observation corroborates the listing’s existence, not its original publication time, claimed volume or contents, password-weakness allegation or operator responsibility. District letters confirm malware encryption and disruption but had not confirmed student or staff information compromise. No ransom payment or initial vector is established.
Ransomware.live observed a RansomHub listing for the provider’s exact domain on Jan. 13, 2025. Comparitech reported Jan. 14 that the group claimed responsibility, alleged theft of 68 GB and set a one-week payment deadline for an unspecified sum. This is an extortion allegation; the provider had not confirmed RansomHub’s involvement. Official notices later confirmed unauthorized network and file access but did not identify an actor, confirm encryption or establish that files were copied. The tracker discovery time is not the original actor-post publication time. Reporting: https://www.comparitech.com/news/ransomware-gang-says-it-hacked-pensacola-fl-medical-clinics/
RansomHub claimed responsibility and alleged theft of 500 GB, demanding an undisclosed payment within a week, according to Comparitech’s Dec. 5, 2024, report. The district had not verified the allegation. Ransomware.live observed the district domain on Dec. 4 and its www alias on Dec. 21; these are duplicate observations of the same victim claim. The tracker observation is not a verified original actor-post timestamp. Neither the claim nor the outage proves encryption, exfiltration or payment.
Ransomware.live lists minneapolisparks.org under RansomHub, discovered Nov. 25, 2024. The Record’s original Nov. 26 reporting says the group claimed the attack Monday, Nov. 25. Tracker discovery is not a verified original publication or intrusion timestamp. The board independently described ransomware and later a data breach, but the reviewed primary records do not confirm RansomHub attribution, a stolen-data volume, a victim count or a ransom payment. Preserve the existing RansomHub entity and its separately sourced research; general affiliate tactics are not findings about this event.
Ransomware.live indexes a RansomHub victim listing for coppelltx.gov, discovered Nov.25,2024 at17:00:52.248040UTC. Original actor-post URL and exact publication time are unavailable; tracker discovery is not the attack date. The Record’s Nov.26 original report says RansomHub took credit the previous Monday. Comparitech’s July4,2025 original report attributes an alleged442GB theft to the group and reports16,835people notified. Original city notices independently establish unauthorized network access Oct.23,2024 and potentially exposed personal information, but do not confirm RansomHub responsibility, the claimed volume, encryption, a ransom demand/payment or full data publication. Keep the allegation explicit with low actor/ransomware confidence. The existing shared RansomHub identity and primary CTI references remain unchanged.
Ransomware.live records a RansomHub victim listing matching the district’s interborosd.org domain. The tracker discovered it Nov. 19, 2024; that timestamp is not an established original publication or intrusion date. The district’s original notice confirms unauthorized file copying between Oct. 13 and Oct. 28 but does not name RansomHub or confirm the group’s responsibility. Preserve this as an unconfirmed claim, separately from the district’s verified findings; the actor’s general techniques are not findings about this incident.
Comparitech’s Feb. 17, 2025, report says RansomHub listed the tribe over the preceding weekend, alleged theft of 119 gigabytes and threatened publication by Feb. 19. The tribe had not confirmed the group’s claim. Its later acknowledgments of ransomware, stolen or leaked information and a refused ransom demand do not independently verify RansomHub’s responsibility or the alleged volume. Exact original claim publication and tracker discovery timestamps remain unknown; the article’s update date is not substituted for either.
March 27 local reporting attributed RansomHub identification to the then-CEO and reported an alleged 572 GB theft. This preserves the reported claim; no direct leak-post date or independently verified volume is available.
