All news
ransomware incident

Precursor Intelligence

Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims

The ransomware group declared its shutdown days before the SatanLock exit, marking a significant contraction in the extortion ecosystem.

18 August 2026
RansomwareData ExtortionHunters InternationalWorld LeaksCybercrime
Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims

At a glance

5 actors2 targets1 industry

Threat actors

NameTypeOriginMotivation
u-bombransomware—financial
Hunters Internationalransomware—financial
Satanlockransomware——
World Leaksransomware—financial
dispossessorransomware——

Targets & victims

OrganisationSectorRegionStatus
NikeRetail/Fashion—confirmed
UBSFinancial Services—confirmed

Industries

Financial Services

Malware & tooling

U-Bomb RansomwareSatanLockWorldLeaksDispossessor Ransomware

Timeline

  1. Emergence

    SatanLock emerged and built a reputation through aggressive extortion tactics.

  2. Shutdown announcement

    SatanLock announced its shutdown and planned leak of all stolen files.

SatanLock Ceases Operations and Announces Mass Data Leak

The SatanLock ransomware group has officially declared the end of its operations, marking a sudden exit from the cybercrime ecosystem. In a public shutdown announcement, the group stated it will leak all stolen data from 67 victims who did not pay ransoms or negotiate successfully. This abrupt cessation follows a broader trend in the industry where groups are shutting down due to increased law enforcement pressure and declining profitability.

The Scale of the Data Exposure

The data release encompasses material from 67 distinct victims, representing a substantial volume of sensitive information exposed in a single event. While the affected organizations span multiple industries, specific sector breakdowns for this particular batch were not detailed in the immediate announcement. This mass publication functions as a final extortion tactic, effectively serving as a 'burning of bridges' move before the group disappears from public view.

Context: A Wave of Ransomware Group Exits

SatanLock’s abrupt cessation follows closely on the heels of Hunters International, which also declared its closure just days prior. This sequence underscores a broader pattern within the ransomware sector, where multiple groups are simultaneously withdrawing from active operations. Hunters International, originally established as a file-encryption group in late 2023, had previously rebranded to World Leaks in January 2025, pivoting its strategy entirely toward data extortion and abandoning encryption tactics.

In its final public statement, the group cited "recent developments" and acknowledged that the decision was not made lightly. The organization recognized the impact of its closure on the entities it had targeted, which included high-profile victims such as Nike, Dell, and UBS. Unlike SatanLock’s approach of mass-leaking stolen data from unpaid victims, Hunters International provided free decryption keys to affected organizations upon exiting. This divergence in exit strategies highlights differing operational motivations within the cybercrime ecosystem, with some groups opting for punitive data exposure while others choose a more conciliatory departure.

Implications for Victims and the Industry

The immediate publication of data from 67 organizations creates an urgent crisis for affected entities, exposing them to significant risks of privacy violations, financial fraud, and lasting reputational harm. Unlike traditional ransomware incidents where encryption is the primary threat, this mass leak prioritizes the exposure of sensitive secrets, meaning that standard backup and recovery protocols offer no protection against the dissemination of stolen information. Security teams must now pivot their focus from restoring system availability to managing the fallout of exposed credentials and proprietary data, a shift that fundamentally alters the defensive calculus for organizations facing pure data extortion tactics.

This event also highlights a notable divergence in how ransomware groups are exiting the ecosystem. While SatanLock has chosen to liquidate its stolen assets through punitive mass leaks, Hunters International opted for a more conciliatory departure by providing free decryption keys to its victims. This contrast underscores a broader shift in operational dynamics, where some actors prioritize final extortionary impact over long-term campaign sustainability, while others seek to mitigate victim damage as they withdraw from active operations.

Key points

  • Hunters International issued a public statement confirming the closure of its project, citing recent developments and the impact on organizations it has interacted with.
  • The group announced a mass leak of stolen data from 67 victims as part of its shutdown process.
  • This exit occurs just days after the SatanLock ransomware group also ceased operations and leaked files from 67 victims, indicating shifting dynamics within the ransomware ecosystem.
  • Hunters International previously rebranded to World Leaks in January 2025, abandoning file encryption for pure data extortion after citing that ransomware had become too risky and unprofitable due to law enforcement pressure.

Further reading & sources