Organisation

World Leaks

Data-extortion operation launched in January 2025 by the operators of Hunters International ransomware.

World Leaks posted more than 200,000 files taken from Tata Electronics in June 2026, including purported Apple and Tesla design files; ransomware.live counts 174 victims claimed by the group, the latest posted on 21 July 2026.

Last refreshed: 12 October 2026 · Appears in 2 active topics

Key Question

Has World Leaks gone quiet since dumping Tata Electronics' Apple and Tesla files?

Timeline for World Leaks

#14 30 Sept

Reused Hive ransomware code

Cybersecurity: Threats and Defences: Mentioned in: Police seize KillSec ransomware leak site

#9 25 Jun

Posted more than 200,000 files stolen from Tata Electronics to its leak site

Cybersecurity: Threats and Defences: World Leaks posts 630GB stolen from Tata

View full timeline →

Follow Iran Conflict 2026 →Follow Cybersecurity: Threats and Defences →

Background

World Leaks is a data-extortion platform run by the operators of Hunters International, a ransomware gang active since late 2023. The platform went live on 1 January 2025 and named its first victim on 29 April 2025. Hunters International announced its own shutdown on 3 July 2025 and offered victims free decryption keys. Hunters had itself been widely read as a successor to Hive, the gang the FBI shut down in January 2023.

The security firm Lexfo found four parts to the platform: a leak site, a negotiation site, an affiliate panel and an "Insider" portal that gives journalists stolen data 24 hours before wider release. World Leaks presents itself as extortion-only, yet Lexfo found victims WHO also had ransomware deployed by Secp0, a group it believes works with World Leaks. Earlier claimed victims include Nike, Dell and UBS.

The Tata Electronics leak in June 2026 ran to over 630GB, with purported Apple manufacturing specifications and Tesla engineering drawings marked TRADE SECRET. World Leaks chose a supplier whose most valuable files belong to its customers. As of 12 October 2026, ransomware.live showed no World Leaks posting after 21 July.

Common Questions

Is World Leaks the same group as Hunters International?

Yes. Hunters International's operators launched World Leaks on 1 January 2025 and moved affiliates to it, then announced Hunters' own shutdown on 3 July 2025, offering victims free decryption keys.Source: Lexfo; Risky Business

What did World Leaks steal from Tata Electronics?

More than 200,000 files totalling 630GB, including purported Apple manufacturing specifications and Tesla Project Highland engineering drawings marked TRADE SECRET.Source: Al Jazeera

Does World Leaks encrypt victims' files like normal ransomware?

It presents itself as extortion-only, stealing data and threatening to publish it. Lexfo found some victims also had ransomware deployed by Secp0, a group it believes works with World Leaks.Source: Lexfo

Which other companies has World Leaks targeted?

It has claimed more than 116 victims since January 2025, including Nike, Dell and UBS.Source: hackread

How many victims has World Leaks claimed?

As of 12 October 2026 ransomware.live listed 174 victims claimed by World Leaks, the most recent posted on 21 July 2026. Earlier claims include Nike, Dell and UBS.Source: ransomware.live

What is the World Leaks Insider platform?

A portal that gives journalists access to stolen data 24 hours before wider publication, one of four parts of the World Leaks platform alongside its leak site, negotiation site and affiliate panel.Source: Lexfo

Source Material

Worldleaks group profile World Leaks: An Extortion Platform World Leaks Hunters International Shuts Down, Offers Free Decryptors as It Morphs Into World Leaks