Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Inactive · #56 by victimsRansomware group
Toufan
As of Oct 19, 2026, Toufan has listed 124 confirmed victims on its leak site since Dec 1, 2023, 0.4% of all victims tracked by Brandefense. Its most targeted country is United States (42.7% of its victims) and its most targeted sector is Retail.
Is My Company Listed?Follow ToufanRequest IOC FeedTTPs, CVEs and malware →
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 124
- Rank By Victims
- #56
- Last Leak-Site Post
- Jan 6, 2026
- Top Country
- United States
- Top Sector
- Retail
Victims Posted Per Month.
0
0
0
0
0
0
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
0
2
1
0
0
0
0
0
0
0
0
0
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 2 |
| January 2026 | 1 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
121
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
1
0
0
0
0
0
0
0
0
0
| Month | Confirmed victims |
|---|---|
| December 2023 | 121 |
| January 2024 | 0 |
| February 2024 | 0 |
| March 2024 | 0 |
| April 2024 | 0 |
| May 2024 | 0 |
| June 2024 | 0 |
| July 2024 | 0 |
| August 2024 | 0 |
| September 2024 | 0 |
| October 2024 | 0 |
| November 2024 | 0 |
| December 2024 | 0 |
| January 2025 | 0 |
| February 2025 | 0 |
| March 2025 | 0 |
| April 2025 | 0 |
| May 2025 | 0 |
| June 2025 | 0 |
| July 2025 | 0 |
| August 2025 | 0 |
| September 2025 | 0 |
| October 2025 | 0 |
| November 2025 | 0 |
| December 2025 | 2 |
| January 2026 | 1 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Toufan Victims.
Search all 124 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| optum-ies.com optum-ies.com | ILIsrael | Healthcare | Not stated | |
| ILDefenseLeaks : UPC Precision Castings Ltd - “upccastings.com” upccastings.com | ILIsrael | Unknown | Not stated | |
| ILDefenseLeaks : Saar Engineering - “saarengineer.com” saarengineer.com | ILIsrael | Unknown | Not stated | |
| ecom.gov.il ecom.gov.il | ILIsrael | Financial Services | Not stated | |
| maytronics.com maytronics.com | USUnited States | Retail | Not stated | |
| ari.co.il ari.co.il | ILIsrael | Manufacturing | Not stated |
How They Operate.
Toufan's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Toufan Targets.
Shares are of this group's confirmed victims.
History.
First confirmed victim listed on its leak site
Busiest month on record: 121 confirmed victims
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.