Ransomware group

Datacarry ransomware: victims and leak site activity

The Datacarry ransomware group has listed 16 victims on its leak site since May 2025; its latest post is from 6 December 2025. Most affected countries: Belgium, Spain and Italy. Most targeted sector: Retail & E-Commerce.

Total posts 16
First seen 2025-05-26
Latest post 2025-12-06
Countries hit 12

About Datacarry

DataCarry is a ransomware and data-extortion operation first observed in May 2025, operating a double-extortion model with a Tor-hosted leak portal and claiming victims across insurance, healthcare, aerospace, legal, and retail sectors in at least six countries.

Leak site (Tor)
http://dcarryhaih5oldidg3tbqwnde4lxljytnpvberrwgj2vlvunopd46dad.onion

Most targeted countries

  1. Belgium 2
  2. Spain 2
  3. Italy 2
  4. Sweden 2
  5. Switzerland 1
  6. Denmark 1
  7. France 1
  8. United Kingdom 1
  9. Greece 1
  10. Latvia 1
All countries →

Most targeted sectors

  1. Retail & E-Commerce 5
  2. Agriculture and Food Production 2
  3. Financial Services 2
  4. Healthcare 2
  5. Transportation 2
  6. Hospitality 1
  7. Professional Services 1
  8. Technology 1
All sectors →

Datacarry victims per year

16 2025

All 16 victims

Search every post in the full table.
Victim Country Sector Discovered
Camomilla Italy Retail & E-Commerce
UAM Spain Transportation
Miljödata (1 day left) Sweden Agriculture and Food Production
Miljödata Sweden Agriculture and Food Production
Peggy Sage France Retail & E-Commerce
Món Sant Benet Spain Hospitality
V² Development Greece Technology
Alliance Healthcare IT Italy Healthcare
La Maison Liégeoise Belgium Retail & E-Commerce
Executive Jet Support United Kingdom Transportation
alles Lægehus Denmark Healthcare
Mammut Sports Group Switzerland Retail & E-Commerce
FrontierCo South Africa Retail & E-Commerce
Étude Bordet Belgium Professional Services
ALB Forex Turkey Financial Services
Balcia Insurance Latvia Financial Services