Ransomnews has confirmed 39 ransomware and extortion attacks since 1 October 2026. Each one is backed by a regulator notice, a regulatory filing or the organisation's own statement, or by press reporting that a Ransomnews editor reviewed. 29 of them (74%) also appeared on a ransomware leak site; 10 have no leak-site listing so far. Updated 11 November 2026, 17:30 UTC.
39Confirmed since 1 Oct 2026
29Also claimed on a leak site
10Never claimed (so far)
11Countries
9 daysMedian, leak-site claim to confirmation
| Confirmed | Organisation | Location | Sector | Group | Evidence | Sources |
|---|---|---|---|---|---|---|
| 2026-11-10 | SANKO TECHNO CO., LTDDisclosed to the Tokyo Stock Exchange on 10 November 2026. The disclosure describes a ransomware or extortion attack. | Japan | Manufacturing | Not claimed | Regulatory filing | TSE disclosure |
| 2026-11-09 | ErowaConfirmed by the organisation in press reports from 9 November 2026. Akira listed the organisation on its leak site on 4 November 2026. | Switzerland | Other | Akiralisted 2026-11-04 | Press reporteditor reviewed | Inside IT |
| 2026-11-08 | Medizinisches Zentrum Gleis DConfirmed by the organisation in press reports from 8 November 2026. The source names Cloak. | Switzerland | Healthcare | Cloaknamed in source | Press reporteditor reviewed | IT-MarktMoneycabwatson.ch |
| 2026-11-07 | Brenner Base Tunnel SE (BBT SE)Confirmed by the organisation in press reports from 7 November 2026. | Italy | Construction | Everest | Press reporteditor reviewed | la RepubblicaMoncloa |
| 2026-11-06 | Santa Barbara EndodonticsData breach notice filed with the California Attorney General, published 6 November 2026. The Gentlemen listed the organisation on its leak site on 16 October 2026. | United States | Other | The Gentlemenlisted 2026-10-16 | Regulator notice | California AG notice |
| 2026-11-04 | Epichealth Medical ClinicsConfirmed by the organisation in press reports from 4 November 2026. The Gentlemen listed the organisation on its leak site on 26 October 2026. | Australia | Healthcare | The Gentlemenlisted 2026-10-26 | Press reporteditor reviewed | Cyber DailyThe Standardteiss |
| 2026-11-04 | Chugoku Bend Co., Ltd.Confirmed by the organisation in press reports from 4 November 2026. Everest listed the organisation on its leak site on 17 October 2026. | Japan | Manufacturing | Everestlisted 2026-10-17 | Press reporteditor reviewed | 合同会社ロケットボーイズ |
| 2026-10-31 | Mairie de Verrières-en-ForezConfirmed by the organisation in press reports from 31 October 2026. | France | Government | Not claimed | Press reporteditor reviewed | cyberattaque.org |
| 2026-10-30 | The Nueva SchoolData breach notice filed with the California Attorney General, published 30 October 2026. Qilin listed the organisation on its leak site on 18 July 2026. | California, United States | Education | Qilinlisted 2026-07-18 | Regulator notice | California AG noticeclaimdepotclaimdepot |
| 2026-10-30 | El Camino HealthData breach notice filed with the California Attorney General, published 30 October 2026. Vortex listed the organisation on its leak site on 9 November 2026. | United States | Healthcare | Vortexlisted 2026-11-09 | Regulator notice | California AG notice |
| 2026-10-30 | Jerome School DistrictConfirmed by the organisation in press reports from 30 October 2026. Interlock listed the organisation on its leak site on 2 November 2026. | Idaho, United States | Education | Interlocklisted 2026-11-02 | Press reporteditor reviewed | Idaho Education NewsGovernment Technology |
| 2026-10-30 | Town of BernalilloConfirmed by the organisation in press reports from 30 October 2026. | New Mexico, United States | Government | Not claimed | Press reporteditor reviewed | KOAT Channel 7KOAT Channel 7 on MSN |
| 2026-10-29 | Del Monte Foods Corporation II Inc.Data breach notice filed with the California Attorney General, published 29 October 2026. Payouts King listed the organisation on its leak site on 31 March 2026. | United States | Food and beverage | Payouts Kinglisted 2026-03-31 | Regulator notice | California AG notice |
| 2026-10-28 | Troutman Pepper Locke LLPData breach notice filed with the California Attorney General, published 28 October 2026. LeakedData listed the organisation on its leak site on 18 August 2026. | United States | Legal | LeakedDatalisted 2026-08-18 | Regulator notice | California AG notice |
| 2026-10-27 | UNM HealthConfirmed by the organisation in press reports from 27 October 2026. BYOD listed the organisation on its leak site on 26 October 2026. | New Mexico, United States | Healthcare | BYODlisted 2026-10-26 | Press reporteditor reviewed | BleepingComputerMezhahipaajournal.com |
| 2026-10-27 | Baker & McKenzie LLPData breach notice filed with the California Attorney General, published 27 October 2026. LeakedData listed the organisation on its leak site on 8 October 2026. | Illinois, United States | Legal | LeakedDatalisted 2026-10-08 | Regulator notice | California AG notice |
| 2026-10-25 | Bathurst RSL ClubConfirmed by the organisation in press reports from 25 October 2026. Qilin listed the organisation on its leak site on 22 October 2026. | Australia | Services | Qilinlisted 2026-10-22 | Press reporteditor reviewed | Cyber Dailykalkinemedia |
| 2026-10-24 | TG-iPASS (Telangana Industries Department)Confirmed by the organisation in press reports from 24 October 2026. | India | Government | Not claimed | Press reporteditor reviewed | The New Indian ExpressThe Times of IndiaMirror Now on MSN |
| 2026-10-23 | Program Consultores S.A.Confirmed by the organisation in press reports from 23 October 2026. | Argentina | Technology | Not claimed | Press reporteditor reviewed | Carlos Paz VivoDiario PopularUrgente24 |
| 2026-10-23 | Oneonta City School DistrictConfirmed by the organisation in press reports from 23 October 2026. Shiba listed the organisation on its leak site on 27 October 2026. | New York, United States | Education | Shibalisted 2026-10-27 | Press reporteditor reviewed | WBNGWSKGYahoo |
| 2026-10-23 | City of ColumbiaConfirmed by the organisation in press reports from 23 October 2026. Qilin listed the organisation on its leak site on 29 October 2026. | South Carolina, United States | Government | Qilinlisted 2026-10-29 | Press reporteditor reviewed | WLTXWLTX on MSNWACH |
| 2026-10-23 | GMO Internet, Inc.Disclosed to the Tokyo Stock Exchange on 23 October 2026. The disclosure describes a ransomware or extortion attack. | Japan | Technology | Not claimed | Regulatory filing | TSE disclosureTSE disclosureTSE disclosure |
| 2026-10-22 | Richmond Public SchoolsConfirmed by the organisation in press reports from 22 October 2026. Interlock listed the organisation on its leak site on 9 November 2026. | Virginia, United States | Education | Interlocklisted 2026-11-09 | Press reporteditor reviewed | Government Technology |
| 2026-10-22 | Dill Dill Carr Stonbraker & Hutchings, P.C.Data breach notice filed with the California Attorney General, published 22 October 2026. Genesis listed the organisation on its leak site on 9 December 2025. | United States | Other | Genesislisted 2025-12-09 | Regulator notice | California AG notice |
| 2026-10-22 | BASS Medical GroupData breach notice filed with the California Attorney General, published 22 October 2026. Booba Team listed the organisation on its leak site on 27 October 2026. | California, United States | Healthcare | Booba Teamlisted 2026-10-27 | Regulator notice | California AG notice |
| 2026-10-21 | Magasin du NordConfirmed by the organisation in press reports from 21 October 2026. Majinahanashi listed the organisation on its leak site on 5 November 2026. | Denmark | Retail | Majinahanashilisted 2026-11-05 | Press reporteditor reviewed | Computerworld |
| 2026-10-21 | CoopecajaConfirmed by the organisation in press reports from 21 October 2026. INC Ransom listed the organisation on its leak site on 10 November 2026. | Costa Rica | Financial services | INC Ransomlisted 2026-11-10 | Press reporteditor reviewed | DPL News |
| 2026-10-21 | Photon HealthData breach notice filed with the Oregon Department of Justice, published 21 October 2026. Dire Wolf listed the organisation on its leak site on 19 August 2026. | United States | Technology | Dire Wolflisted 2026-08-19 | Regulator notice | Oregon DOJ noticeCalifornia AG notice |
| 2026-10-19 | enTouch Inc.Disclosed to the Tokyo Stock Exchange on 19 October 2026. The disclosure describes a ransomware or extortion attack. Black X listed the organisation on its leak site on 9 October 2026. | Japan | Healthcare | Black Xlisted 2026-10-09 | Regulatory filing | TSE disclosure |
| 2026-10-18 | Kissei Shoji Co., Ltd.Confirmed by the organisation in press reports from 18 October 2026. Everest listed the organisation on its leak site on 16 October 2026. | Japan | Retail | Everestlisted 2026-10-16 | Press reporteditor reviewed | 合同会社ロケットボーイズ |
| 2026-10-18 | Poole GroupConfirmed by the organisation in press reports from 18 October 2026. | Australia | Financial services | LockBit 5.0 | Press reporteditor reviewed | Accountants Daily |
| 2026-10-14 | SeetelhotelsConfirmed by the organisation in press reports from 14 October 2026. INC Ransom listed the organisation on its leak site on 20 October 2026. | Germany | Services | INC Ransomlisted 2026-10-20 | Press reporteditor reviewed | Ostsee ZeitungTageskarteNordkurier |
| 2026-10-13 | The City of Mt. AngelData breach notice filed with the Oregon Department of Justice, published 13 October 2026. Booba Team listed the organisation on its leak site on 20 October 2026. | United States | Government | Booba Teamlisted 2026-10-20 | Regulator notice | Oregon DOJ notice |
| 2026-10-13 | Mandurah State Emergency ServiceConfirmed by the organisation in press reports from 13 October 2026. The Gentlemen listed the organisation on its leak site on 2 October 2026. | Australia | Government | The Gentlemenlisted 2026-10-02 | Press reporteditor reviewed | Cyber Daily |
| 2026-10-13 | American Board of Preventive MedicineData breach notice filed with the California Attorney General, published 13 October 2026. Genesis listed the organisation on its leak site on 9 May 2026. | United States | Other | Genesislisted 2026-05-09 | Regulator notice | California AG notice |
| 2026-10-13 | Magna Hospitality GroupData breach notice filed with the California Attorney General, published 13 October 2026. Qilin listed the organisation on its leak site on 22 October 2025. | Rhode Island, United States | Services | Qilinlisted 2025-10-22 | Regulator notice | California AG notice |
| 2026-10-08 | Hood River DentalData breach notice filed with the Oregon Department of Justice, published 8 October 2026. Bravox listed the organisation on its leak site on 23 January 2026. | United States | Healthcare | Bravoxlisted 2026-01-23 | Regulator notice | Oregon DOJ notice |
| 2026-10-06 | Harman FitnessData breach notice filed with the California Attorney General, published 6 October 2026. NetRunner listed the organisation on its leak site on 1 April 2026. | California, United States | Services | NetRunnerlisted 2026-04-01 | Regulator notice | California AG notice |
| 2026-10-01 | IDC FrontierConfirmed by the organisation in press reports from 1 October 2026. | Japan | Technology | Not claimed | Press reporteditor reviewed | news.sbs.co.krBleepingComputer週刊アスキー |
How this register works
What counts. An attack is listed when the organisation, a regulator, a regulatory filing or a court record confirms a cyberattack, and either that source itself says ransomware, encryption or extortion, or a ransomware group listed the same organisation on its leak site around the same time. Data breaches with no ransomware or extortion element are not listed.
Where it comes from. Ransomnews collects state attorney-general breach notices, SEC Form 8-K cybersecurity disclosures, stock-exchange disclosures, company statements and press reports every hour, and matches each organisation against every listing in the Ransomtracker leak-site feed. Attacks backed by a primary source are published automatically; attacks known only from press reports are published after an editor reviews them.
Claimed vs unclaimed. "Also claimed on a leak site" means a group listed the organisation within the incident window. "Not claimed" means no listing has been found yet: some victims pay, some groups never publish, and some listings use a different name. Leak-site claims on their own are not confirmation, which is why daily leak-site counts are far higher than this register.
Dates. "Confirmed" is the date of the first primary source (or, for reviewed press reports, the first report). Listing dates are in UTC. Attacks before 1 October 2026 are in the historical confirmed-attacks dataset.
Corrections. If an entry is wrong, tell us and include a source.