Overview
Platforms:
Windows · Linux
Variants:
—
Extensions:
—
ATT&CK software:
—
Initial access:
—
Top countries:
US · GB · CA · DE · JP
Observed sectors:
Healthcare · Manufacturing · Retail & Hospitality · Construction & Engineering · Energy
Tracked victims:
177
Attribution
Hunters International
VERIFIED
Verified predecessor / rebrand lineage
Group-IB directly observed Hunters International administrators announcing and operating World Leaks as their successor project, with a strategic shift from ransomware encryption toward data-only extortion.
Affiliates
No affiliate information available.
Activity
Recent Observations
Continued World Leaks disclosures
July 2026
Data-extortion activity
World Leaks continued publishing stolen datasets during July 2026, including information associated with major enterprise and critical-infrastructure supply chains.
Kudankulam-related files published
July 2026
Critical-infrastructure exposure
World Leaks published approximately 19,000 files associated with India's Kudankulam Nuclear Power Plant project. Reliance Group confirmed a partial breach involving data stored at a third-party data center while authorities stated that core nuclear systems were not compromised.
Tata Electronics data publication
June 2026
Major data breach
World Leaks published more than 200,000 files allegedly obtained from Tata Electronics. Tata confirmed a cyber breach affecting parts of its IT infrastructure while the leaked material reportedly included engineering and manufacturing information associated with major technology customers.
Dell Solution Center breach
July 2025
Major data breach
Dell confirmed unauthorized access to its Customer Solution Centers environment after World Leaks claimed the breach and attempted to extort the company.
World Leaks becomes the primary successor operation
May 2025
Operational transition
As Hunters International ended sustained ransomware activity, World Leaks became the operators' primary data-extortion platform and began publishing victims at scale.
TTPs
ATT&CK coverage:
1 techniques
· 1 tactics
T1020
Automated Exfiltration
VERIFIEDExfiltration
World Leaks operators advertised a dedicated tool designed to automate the exfiltration of victim data as the central capability of the extortion-only operation.
Victims
Reliance Group
CONFIRMED
Architecture / Engineering organization in IN.
Tata Electronics
CLAIMED
Technology organization in India.
Dell Technologies
CLAIMED
Technology organization in United States.
Chain IQ
CONFIRMED
Professional Services organization in CH.
CVEs
No CVE associations available.
Infrastructure
World Leaks leak site
World Leaks operated dedicated leak infrastructure used to publish stolen corporate data and pressure victims through public disclosure.
World Leaks affiliate panel
Hunters International administrators created a dedicated World Leaks partner platform as part of the transition from ransomware encryption to data-only extortion.
Automated exfiltration tooling
World Leaks advertised a self-developed tool designed to automate data exfiltration and support proxy-mediated transfer of stolen information.
Extortion infrastructure
The operation centers on managing stolen datasets, victim communications and publication rather than deploying encryption payloads.
Timeline
2026-09
Current operational status uncertain
No formal shutdown or law-enforcement disruption has been identified, but recent public victim activity is absent and monitored leak infrastructure has been reported unavailable. The operation is therefore assessed as UNKNOWN rather than definitively inactive.
2026-07
Kudankulam-related data exposure
World Leaks published files linked to the Kudankulam Nuclear Power Plant project following a confirmed partial breach involving Reliance Group data hosted by a third-party provider.
2026-07
Last confidently observed public activity
The last specifically dated new World Leaks victim publication identified in current public monitoring was observed on July 21, 2026.
Show more events (4)
2026-06
Tata Electronics breach
Tata Electronics confirmed a cyber breach after World Leaks published a large dataset allegedly containing sensitive manufacturing and engineering information.
2025-07
Dell breach
Dell confirmed unauthorized access to a product demonstration environment after World Leaks claimed to have stolen data from the platform.
2025-05
World Leaks becomes operational successor
Hunters International completed its transition away from sustained ransomware activity while World Leaks began publishing stolen datasets through its new extortion platform.
2025-01
World Leaks project launched
Hunters International administrators launched World Leaks as a successor project focused on data theft and extortion rather than ransomware encryption.
Sources
Show more sources (9)
Files relating to India's largest nuclear power plant Kudankulam exposed in data breach
Reuters
Incident report
Worldleaks ransomware group activity
Digital Checkmark
World Leaks threat entity
ThreatCluster
World Leaks Ransomware Group Adds Stealthy, Custom Malware RustyRocket to Attacks
Infosecurity Magazine / Accenture Cybersecurity research
NCSC Semi-Annual Report 2025/I
Swiss National Cyber Security Centre