Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Hive
As of Oct 19, 2026, Hive has listed 211 confirmed victims on its leak site since Jul 11, 2025, 0.7% of all victims tracked by Brandefense. Its most targeted country is United States (28.4% of its victims) and its most targeted sector is Consulting.
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 211
- Rank By Victims
- #29
- Last Leak-Site Post
- Jul 11, 2025
- Top Country
- United States
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| July 2025 | 211 |
| August 2025 | 0 |
| September 2025 | 0 |
| October 2025 | 0 |
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Hive Victims.
Search all 211 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| R C Stevens Construction rcstevens.com | USUnited States | Unknown | Not stated | |
| G.W. Becker gwbcrane.com | USUnited States | Unknown | Not stated | |
| Stolle Machinery stollemachinery.com | USUnited States | Manufacturing, Mining | Not stated | |
| JAKKS Pacific Inc jakks.com | USUnited States | Retail | Not stated | |
| Alvaria alvaria.com | USUnited States | Telecommunications, Technology | Not stated | |
| MHMR Authority Of Brazos Valley mhmrabv.org | USUnited States | Healthcare | Not stated |
How They Operate.
Hive's threat actor profile lists 6 ATT&CK techniques, 6 exploited CVEs, 20 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Hive Targets.
Sectors
History.
First seen in Brandefense data
Busiest month on record: 211 confirmed victims
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.