Ransomware group
Benzona ransomware: victims and leak site activity
The Benzona ransomware group has listed 14 victims on its leak site since November 2025; its latest post is from 30 January 2026. Most affected countries: Romania, Côte d'Ivoire and France. Most targeted sector: Healthcare.
Total posts
14
First seen
2025-11-26
Latest post
2026-01-30
Countries hit
8
About Benzona
Benzona is a financially motivated ransomware group that emerged in late 2024, targeting small to mid-sized organizations across manufacturing, healthcare, technology, and hospitality sectors using double-extortion tactics — encrypting files while exfiltrating data and threatening publication via a Tor-based leak site.
Most targeted countries
All countries →Most targeted sectors
- Healthcare 3
- Manufacturing 3
- Retail & E-Commerce 2
- Hospitality 1
- Professional Services 1
- Technology 1
Benzona victims per year
All 14 victims
Search every post in the full table.| Victim | Country | Sector | Discovered |
|---|---|---|---|
| casamedica.com.gt | Guatemala | Healthcare | |
| empreinte-hotel.com | France | Hospitality | |
| *a*ame*i*a.com.g* | — | — | |
| ccbrt.org | Tanzania | Healthcare | |
| em***int*-ho***.com | — | — | |
| cc***.or.*z | — | — | |
| taminsho.com | Iran | Retail & E-Commerce | |
| platinumone.in | India | Technology | |
| SUNNYGO.COM.TW | Taiwan | Retail & E-Commerce | |
| suzuki-ploiesti.ro | Romania | Manufacturing | |
| poliserv.ro | Romania | Professional Services | |
| mazda-ploiesti.ro | Romania | Manufacturing | |
| dacia-ploiesti.ro | Romania | Manufacturing | |
| sevci.org | Côte d'Ivoire | Healthcare |