lapsus$
Intelligence Profile
Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.
Intelligence Assessment
Lapsus$ is a financially motivated, internationally composed data extortion group. Active from mid-2021 through 2022, the group conducted high-profile breaches against major companies by stealing source code and threatening leaks rather than encrypting files. Several members, predominantly teenagers, were arrested in the UK.
This actor has tracked 29 victims in total, with 8 new victims in the last 90 days. Top affected sectors include Technology, Consumer Services, and Education, with top countries being France, the United States, and Germany.
Lapsus$ has been observed using techniques such as creating valid accounts (T1136.003), disabling or modifying system firewalls (T1578.003), exploiting public-facing applications (T1068), and gathering information about victims' organizations (T1589). They also engage in data destruction (T1489), service stop (T1531), and data encrypted for impact (T1485).
Lapsus$'s last observed activity was on 2026-03-18, and the last attack was on 2026-06-23, indicating that this actor is currently active. The presence of 8 new victims in the last 90 days suggests ongoing activity, despite the arrests of some members.
Threat Analysis
lapsus$ is a ransomware operation that deploys encryption-based extortion against organizations globally. This group maintains a data leak site (DLS) to pressure victims into paying ransom demands.
Financially motivated threat actors like lapsus$ prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (29)
CTIWATCH tracks 29 organizations claimed as victims by lapsus$ on its data leak site, with attack dates, sectors and countries.
View full victims list →TTPs — Tactics, Techniques & Procedures (43)
Known Campaigns
Lapsus$ is conducting an active ransomware campaign targeting organizations across 2 countries. Primary targets: Healthcare, Technology. 7 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 8 Apr 2026).