Skip to content
DysruptionHub
Sign in Subscribe

Wallstreet

Ransomware Group3 claimsLast activity:

Overview

Wallstreet is an emerging ransomware and data-extortion operation first tracked publicly in late June 2026. Ransomware.live dates the operation’s appearance to June 26. Public reporting does not establish the operators’ identities, location, code lineage, affiliate structure or relationship to an earlier group.

Activity and targeting

Red Piranha described Wallstreet as active during July 4-10 and listed alleged victims in government, health care, insurance and automotive services across several countries. The small public sample supports describing its activity as multisector, but it does not establish a fixed targeting strategy. Ransomware.live continued to index Wallstreet victim claims in August.

Methods and operational characteristics

Wallstreet operates a data-leak site used to name alleged victims and pressure them with threatened disclosure. Its Andover listing asserted several data categories and displayed a countdown before further information would be revealed. Public technical reporting has not established an encryptor, ransom-note format, malware family, access vector or Wallstreet-specific technical indicators beyond the leak-site infrastructure. Encryption and the authenticity of actor-claimed data therefore remain unconfirmed.

What type of group is it?

Wallstreet presents as a financially motivated ransomware and data-extortion operation. That classification is based on its leak-site model and public threat-intelligence tracking, not on verified malware analysis or confirmed victim reporting. Its operating structure, membership, technical capabilities and possible links to other actors remain unresolved.

Incident claims

Green Clinic ransomware incident

Incident date: Source: ransomware.livePublished:

Claim details

Ransomware.live indexed Green Clinic under Wallstreet, recorded as discovered Oct. 14, 2026, with a link to the clinic’s Oct. 8 cybersecurity notice. The original actor post, claim-publication date, alleged data and listing authenticity remain unverified. The clinic’s Oct. 8 notice associated the attack with an actor identifying itself as Wall Street or an affiliate; this is qualified victim attribution, not independent authentication of the listing. Earlier Lincoln Parish Journal reporting cited anonymous clinic sources who named Wallstreet and described communication with the clinic; the outlet did not independently review that correspondence or confirm a ransom demand.

Cedar County Memorial Hospital cyberattack

View public claim
Incident date: Source: ransomware.liveDiscovered:

Claim details

A ransomware group calling itself Wallstreet published a page naming Cedar County Memorial Hospital on its data-leak site Aug. 28. The page showed the claim’s countdown at zero and provided access to a browsable dump of files that Wallstreet claimed came from the hospital. We reviewed the page but have not independently verified the files’ authenticity, scope or source.

Andover Town and Schools Cyberattack

Incident date: Source: ransomware.liveDiscovered:

Claim details

Wallstreet listed `Andover` and used a description identifying the Town of Andover, Massachusetts. The listing asserted possession of documents, databases, emails, personal data and media and displayed a countdown before a redacted confidential item would be revealed. The claim is unverified and does not establish access, theft, encryption, a ransom demand or responsibility for the Aug. 13 cyberattack.

Impacted organizations

Impacted locations

Sources

Created Last updated