Ransomware Group intelligence
ExfilSquad
ActiveTrack ExfilSquad with 28 published victims and 1 known leak locations in a single intelligence view.
Overview
ExfilSquad is tracked by Breach House as a ransomware group with 28 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | exfil5gqmbxrg6yky5aeitkdj7kfwxxjh3wxzrtlewjqi2x67o634iyd.onion |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (28)
Search, filter and paginate the victim timeline for ExfilSquad. Showing 1–28 of 28.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Analog Devices id30862 View details | United States | Manufacturing / Engineering | — | |
|
Analog Devices, Inc. is a leading American semiconductor company specializing in data conversion, signal processing, and power management technology. Headquartered in the US, the company designs, manufactures, and markets a wide range of analog, mixed-signal, and digital signal processing integrated circuits. Analog Devices serves various sectors including industrial, automotive, and consumer markets. It was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | Analog Devices id30862 View details | United States | Manufacturing / Engineering | — | |
|
Revenue: $12.7B DATA SUMMARY: 570K~ records containing: customer PII and addresses. |
|||||
| Ransomware | Bonava id30863 View details | Sweden | Construction / Real Estate | — | |
|
Bonava.se is a Swedish company operating in the construction and real estate sector, offering various services related to housing development. Located in Sweden, the company is involved in the development of residential and commercial properties. Bonava.se was listed as a ransomware victim associated with ExfilSquad. |
|||||
| Ransomware | Bonava id30863 View details | Sweden | Construction / Real Estate | — | |
|
Revenue: SEK 8B DATA SUMMARY: 842K~ records containing: significant PII, property ownership/interests, warranty and repair cases, contractor information, marketing preferences, and customer service history. |
|||||
| Ransomware | City of Atlanta id30864 View details | United States | Public Sector | — | |
|
The city of Atlanta's official government website atlantaga.gov provides various services and information to its residents, including public safety, transportation, and community development. As a public sector entity in the US, it offers a range of resources and support to the local community. Atlanta city government was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | City of Atlanta id30864 View details | United States | Public Sector | — | |
|
DATA SUMMARY: 3M~ records containing: significant PII, citizen service requests, addresses, municipal case history, and internal case management data. |
|||||
| Ransomware | City of Houston id30865 View details | United States | Public Sector | — | |
|
Houstontx.gov is the official website of the city of Houston, Texas, providing various public services and information to its residents. The city government offers a range of services, including public safety, transportation, and community development. Houstontx.gov is a key resource for citizens, businesses, and visitors, offering access to city news, events, and online services. It was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | City of Houston id30865 View details | United States | Public Sector | — | |
|
DATA SUMMARY: 6M~ records containing: significant PII, resident contact details, service requests, complaint descriptions, addresses, location data, case/ticket metadata, department routing, service status, resolution information, and extensive CRM metadata. |
|||||
| Ransomware | Viavi Solutions id30866 View details | United States | IT | — | |
|
Viavi Solutions is a US-based company operating in the IT sector, providing network and service enablement solutions. The company offers a range of products and services to help customers manage and optimize their networks. Viavi Solutions was listed as a ransomware victim associated with ExfilSquad. |
|||||
| Ransomware | Viavi Solutions id30866 View details | United States | IT | — | |
|
Revenue: $1B DATA SUMMARY: 430K~ records containing: customer and partner contact information, significant PII, and enterprise account identifiers. |
|||||
| Ransomware | Newcastle University id30867 View details | United Kingdom | Education | — | |
|
Newcastle University, located in the United Kingdom, is a public research university offering a wide range of academic programs. As an institution in the education sector, it provides various undergraduate and postgraduate degree programs. ncl.ac.uk was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | Newcastle University id30867 View details | United Kingdom | Education | — | |
|
DATA SUMMARY: 440K~ records containing: applicant and student contact information, significant PII, and admissions data. |
|||||
| Ransomware | District of Columbia Public Schools id30868 View details | United States | Education | — | |
|
dcps.dc.gov is the official website of District of Columbia Public Schools, providing educational services to students in Washington, D.C. The entity operates within the education sector in the US, offering various academic programs and resources. dcps.dc.gov was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | District of Columbia Public Schools id30868 View details | United States | Education | — | |
|
[AI generated] District of Columbia Public Schools (DCPS) is a public school district serving Washington, D.C., USA. It operates as the primary government-run K-12 educational system for the nation's capital, overseeing dozens of schools, thousands of students, and a large workforce of educators and administrators. DCPS falls under the education sector and is governed by the D.C. government, focusing on curriculum development, student achievement, and community engagement. |
|||||
| Ransomware | Zenith Bank Plc id30869 View details | Nigeria | Finance / Legal / Insurance | — | |
|
Zenith Bank is a financial services provider based in Nigeria, offering a range of banking and financial products to individuals and businesses. The bank operates in the finance, legal, and insurance sector, providing services such as corporate and retail banking. Zenith Bank was listed as a ransomware victim associated with ExfilSquad. |
|||||
| Ransomware | Zenith Bank Plc id30869 View details | Nigeria | Finance / Legal / Insurance | — | |
|
Revenue: ₦2.3T DATA SUMMARY: 90M~ records containing: extensive PII, banking relationships, account information, financial data, government identifiers, customer contact information, and banking support cases. |
|||||
| Ransomware | Frontier Airlines id30870 View details | United States | Transportation / Travel / Logistics | — | |
|
Flyfrontier.com is a website of Frontier Airlines, a US-based low-cost carrier operating scheduled flights to over 100 destinations. The airline offers a range of travel services, including flights, hotels, and car rentals. Flyfrontier.com is part of the transportation sector, providing online booking and management services to its customers. It was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | Frontier Airlines id30870 View details | United States | Transportation / Travel / Logistics | — | |
|
Revenue: $1.5B DATA SUMMARY: 2.4M~ records containing: significant PII, customer support cases, flight and travel information, complaint records, baggage details, and customer support email communications. |
|||||
| Ransomware | TaylorMade & Sun Day Red golf id30871 View details | United States | Manufacturing / Engineering | — | |
|
TaylorMadeGolf.com is the official website of TaylorMade Golf, a leading American golf equipment and apparel manufacturer based in the US. The company designs and produces a wide range of golf clubs, balls, and accessories for professional and amateur golfers. TaylorMade Golf operates in the manufacturing and engineering sector, providing innovative products to the global golf industry. It was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | TaylorMade & Sun Day Red golf id30871 View details | United States | Manufacturing / Engineering | — | |
|
Revenue: $1.5B DATA SUMMARY: 2M~ records containing: significant PII, customer support history, orders, shipping information, business account data, financial/account information, internal notes, attachments, and AI support chat transcripts. |
|||||
| Ransomware | Allstate id30872 View details | United States | Finance / Legal / Insurance | — | |
|
Allstate.com is a prominent online presence of The Allstate Corporation, a leading American insurance company headquartered in the US, offering a wide range of insurance products and services to customers across the country. The company operates in the finance and insurance sector, providing various types of insurance coverage, including auto, home, and life insurance. Allstate.com was listed as a ransomware victim associated with ExfilSquad. |
|||||
| Ransomware | Allstate id30872 View details | United States | Finance / Legal / Insurance | — | |
|
Revenue: $67B DATA SUMMARY: 657K~ records containing: significant PII, recruitment and licensing information, onboarding data, and internal employee account information. |
|||||
| Ransomware | Microsoft id30873 View details | United States | IT | — | |
|
Microsoft.com is the official website of Microsoft, a leading American multinational technology company based in the US, operating in the IT sector, and offering a wide range of software, services, and solutions. The company is known for its Windows operating system, Office software, and Azure cloud computing platform. Microsoft.com was listed as a ransomware victim associated with ExfilSquad |
|||||
| Ransomware | Microsoft id30873 View details | United States | IT | — | |
|
Revenue: $318B DATA SUMMARY: 8M~ records containing: significant PII, employee and customer contact information, authentication data, password hashes, portal identities, corporate account information, business leads, facilities management records, internal service tickets, and access permissions. |
|||||
| Ransomware | Police National Legal Database id30874 View details | United Kingdom | Public Sector | — | |
|
The Police National Legal Database is a comprehensive legal database utilized by law enforcement agencies in Great Britain, providing access to a wide range of legal information and resources. It operates within the public sector, supporting the work of police forces across the country. The database offers a centralized platform for accessing legislation, case law, and other legal materials. It was listed as a ransomware victim associated with ExfilSquad. |
|||||
| Ransomware | Police National Legal Database id30874 View details | United Kingdom | Public Sector | — | |
|
DATA SUMMARY: 135k law enforcement contact records with first/last name, email, police force area, etc. |
|||||
| Ransomware | UK Department for Education id30875 View details | United Kingdom | Public Sector | — | |
|
Education.gov.uk is the official website of the Department for Education in the United Kingdom, providing information and resources on education policies, initiatives, and services to the public. Located in GB, the website serves as a central hub for education-related inquiries and support. The Department for Education operates within the public sector, overseeing various aspects of education in England. Education.gov.uk was listed as a ransomware victim associated with ExfilSquad. |
|||||
| Ransomware | UK Department for Education id30875 View details | United Kingdom | Public Sector | — | |
|
DATA SUMMARY: Help Portal (~600K records) – Parent and staff contact records containing full names, email addresses, phone numbers, and job titles. Turing Portal (~7K records) – Contact records containing full names, email addresses, phone numbers, and job titles. |
|||||