Ransomware Group intelligence
Exitium
ActiveTrack Exitium with 5 published victims and 1 known leak locations in a single intelligence view.
Overview
Exitium is tracked by Breach House as a ransomware group with 5 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | m3ksukzn2glzfdvlusohril7n3iyk4z4fudf6mm22lwhpbpt5aiee5qd.onion |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (5)
Search, filter and paginate the victim timeline for Exitium. Showing 1–5 of 5.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Gastroenterology & Hepatology of CNY[FULL_LEAK] id29188 View details | United States | Healthcare / Pharma | ||
|
Gastroenterology & Hepatology of CNY is a gastroenterology practice based in Syracuse, New York, with offices in Liverpool, US, providing specialized digestive and liver care to patients in Central New York. The practice operates multiple locations including North Medical Plaza in Liverpool and Brittonfield Medical Center in East Syracuse, offering comprehensive medical services through a team of physicians and nurse practitioners. It was listed as a ransomware victim associated with exitium after the Exitium group claimed responsibility for an attack in April 2026. |
|||||
| Ransomware | Gastroenterology & Hepatology of CNY id28206 View details | United States | Healthcare / Medicine | ||
|
Website: gandhofcny.com Zoominfo: https://www.zoominfo.com/c/gastroenterology--hepatology-of-cny-pc/346091487 Data sample, whole internal data will be sold if they wouldn't pay ransom. Also Digestive Disease Center of CNY, LLC (ddcofcny.com) GI practice + AAAHC-accredited endoscopy center. Syracuse, New York, USA. Full database for sale — 167,303 patients, 124,761 SSN, 49,798 with sensitive diagnoses: - 167,303 patients — 124,761 with SSN, 166,402 (99%) with address, 164,296 (98%) with phone, 85,318 (51%) with email - 1,093,863 diagnoses (ICD-10), 1,547,142 medications, 186,246 pathology specimens with narrative reports - Sensitive (dx + meds): 49,798 patients — 44,861 with SSN. Mental health: 43,902 | Substance/Alcohol: 5,111 | STIs: 2,779 | Cancer: 2,708 | Hepatitis C: 1,906 - Includes notable individuals (politicians, businesspeople, public figures) |
|||||
| Ransomware | Ming Hwei Energy id27655 View details | Taiwan, Province of China | Energy | ||
|
Zoominfo: https://www.zoominfo.com/c/ming-hwei-energy-co-ltd/446006038 A small private B2B firm (11–50 staff, <$5M revenue), part of a Taiwanese fastener conglomerate. Manufacturer of solar cells in a niche where Taiwanese firms are consistently undercut by Chinese pricing. Their infra encrypted. |
|||||
| Ransomware | Marborges Agroindustria id27537 View details | Brazil | Agriculture / Food | ||
|
Zoominfo: https://www.zoominfo.com/c/marborges-agroindustria/547271801 Company in Brasil with a bad security. |
|||||
| Ransomware | Fannin CAD id27399 View details | United States | Public Sector | ||
|
Zoominfo: https://www.zoominfo.com/pic/fannin-central-appraisal-district/1117264519 Exfiltrated: 400 GB of data |
|||||