World Leaks does not encrypt files. It is an extortion-only operation that the people behind Hunters International launched on 1 January 2025, and its affiliates are given a custom data exfiltration tool rather than a locker. Victims are contacted by email with a .onion address plus a login and password for a negotiation panel that shows the stolen folders, a countdown and a chat window. Unpaid data goes to a Tor leak site that lists each claimed organisation with a release timer and a browsable file explorer, and a separate portal gives registered journalists a day's early look. With no World Leaks encryptor there is nothing of its own to decrypt, so the work is breach response: preserve logs, establish what left the network and take legal advice on notification duties. Researchers have still seen ransomware deployed in some World Leaks intrusions, including a January 2026 healthcare case where data went to MEGA before encryption, so if files are locked, identify that payload separately. Hunters International shut down in July 2025 after this rebrand; see the Hunters International page.
Sources: Group-IB, BleepingComputer, Lexfo, Darktrace
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161