Privacy UnpackedRansomware gang
Cl0p (also tracked as Cl0p)
Claims on its leak site since 13 March 2020, number 7 of all gangs in the last 12 months
- Claims, 12 months
- 342
- Last 30 days
- 1
- All claims
- 1,366
- Last claim
- 21 October 2026
Where its claimed victims are
Sectors
Claims matched to an official notice
30 organisations Cl0p claimed also filed a breach notice with a regulator, 27 of them after the claim (a median of 98 days later). Matched by name: the notice does not say who the attacker was.
- Check City
Claimed 9 May 2025 · notice filed with the California Attorney General 19 March 2026 - Maritz Holdings Inc.
Claimed 13 November 2025 · notice filed with the California Attorney General 27 February 2026 - Gardner Health Services
Claimed 27 February 2025 · notice filed with the California Attorney General 23 December 2025 - Cox Enterprises, Inc.
Claimed 27 October 2025 · notice filed with the California Attorney General 20 November 2025 - The Washington Post
Claimed 7 November 2025 · notice filed with the California Attorney General 12 November 2025 - GlobalLogic Inc.
Claimed 13 November 2025 · notice filed with the California Attorney General 7 November 2025 - Cierant Corporation
Claimed 1 February 2025 · notice filed with the California Attorney General 7 July 2025 - Western Alliance Bank (“WAB”)
Claimed 24 January 2025 · notice filed with the California Attorney General 14 March 2025 - Biagi Bros, Inc.
Claimed 10 February 2025 · notice filed with the California Attorney General 25 February 2025 - Kirkland & Ellis LLP
Claimed 29 June 2023 · notice filed with the California Attorney General 12 June 2024 - AbbVie Inc.
Claimed 26 June 2023 · notice filed with the California Attorney General 21 May 2024 - Baesman Group, Inc.
Claimed 20 June 2023 · notice filed with the California Attorney General 29 February 2024 - Planet Home Lending, LLC
Claimed 26 July 2023 · notice filed with the Washington Attorney General 23 January 2024 - TGI Direct
Claimed 12 July 2023 · notice filed with the Washington Attorney General 17 January 2024 - AutoZone, Inc.
Claimed 7 July 2023 · notice filed with the California Attorney General 20 November 2023 - AlohaCare
Claimed 26 July 2023 · notice filed with the California Attorney General 3 November 2023 - Westat, Inc.
Claimed 10 July 2023 · notice filed with the Washington Attorney General 3 November 2023 - Alogent
Claimed 26 July 2023 · notice filed with the California Attorney General 26 September 2023 - Kannact, Inc.
Claimed 23 March 2023 · notice filed with the California Attorney General 22 September 2023 - Cadence Bank
Claimed 6 July 2023 · notice filed with the California Attorney General 15 September 2023 - CareSource
Claimed 29 June 2023 · notice filed with the California Attorney General 28 August 2023 - Maximus, Inc.
Claimed 26 July 2023 · notice filed with the Washington Attorney General 25 August 2023 - Jackson
Claimed 29 June 2023 · notice filed with the California Attorney General 16 August 2023 - American National Group, LLC
Claimed 7 July 2023 · notice filed with the California Attorney General 9 August 2023 - Rite Aid Corporation
Claimed 11 July 2023 · notice filed with the California Attorney General 19 July 2023 - Imagine360
Claimed 24 March 2023 · notice filed with the California Attorney General 30 June 2023 - NationsBenefits Holdings, LLC
Claimed 23 March 2023 · notice filed with the California Attorney General 14 April 2023 - US Wellness Inc.
Claimed 16 March 2023 · notice filed with the California Attorney General 22 March 2023 - Hatch Bank
Claimed 6 March 2023 · notice filed with the California Attorney General 28 February 2023 - Order Express, Inc.
Claimed 22 December 2022 · notice filed with the California Attorney General 15 December 2022
What a claim is, and is not
A claim is a ransomware gang naming an organisation on its leak site, usually to pressure it into paying. It is the gang’s word: some claims are false, recycled from older breaches or exaggerated, and a claim says nothing about whose personal data, if any, was taken. That is why we count claims but do not list the organisations, and why a breach goes on the tracker as confirmed only when the organisation or a regulator says so.
How this is counted
Claims as collected from the gangs’ leak sites by ransomware.live, which says itself that they are unverified. We read its list every day and keep only counts: by month, by the victim’s country and by sector (as ransomware.live classifies them). Matches with official notices are by the organisation’s name, from 30 days before the claim to a year after it, against California’s and Washington’s full breach registers and every official notice on the tracker. A match is not a confirmation rate: those registers only see breaches of their own residents, and names are written differently. We never link to or visit leak sites.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.