Scarlettgroup — Ransomware Profile

Scarlettgroup is a data-extortion crew that WatchGuard's ransomware tracker classifies as a data broker using direct and double extortion alongside free data leaks, with a first sighting in September 2026. Beyond its Tor-hosted leak site, WatchGuard records accounts under the scarlettgroup name on the BreachForums and PwnForums hacking forums, a Session messenger contact and a Telegram channel. Its first listed victim was the Yale Books website of Yale University Press, which DeXpose reported the group announced on 8 October 2026, and leak-site trackers have since recorded a second listing naming the Rajasthan Police in India. These listings are the group's own claims and have not been confirmed by the organisations named.

IntelFusions coverage (1)

Rajasthan Police and two health providers on leak sites 2026-10-24 · Cyber Incidents

Recent claimed victims

VinSolutions 2026-10-23
Rajasthan Police 2026-10-21
Genesys Cloud Services, Inc. 2026-10-21
NBCUniversal 2026-10-21
yalebooks.yale.edu 2026-10-08

Vendor research

Scarlettgroup Ransomware (Ransomware Tracker) WatchGuard Technologies

Read the full analysis on IntelFusions