Confirmed ransomware attacks, October 2026: 25 verified so far, Everest and The Gentlemen lead

Ransomnews has confirmed 25 ransomware and extortion attacks for October 2026 so far, against 58 for September and 121 for October 2025. The figure is provisional and will rise for months. Everest and The Gentlemen lead with three confirmed victims each, government is the most-hit sector with five, and in 11 of the 19 incidents with a leak-site listing the gang went public before the victim did.

The count, and why it will rise

A month’s count is lowest the week it closes. An attack enters the dataset only once the organisation, a regulator or a stock-exchange filing confirms it, and most of those confirmations come weeks or months later. August is the clearest example: it stood at 51 when we published its report on 7 September and is at 116 now. Between October 2025 and August 2026, months settled between 85 and 129. This report first ran on 11 November with 13 incidents; a review of press-confirmed cases the same day took it to 25, and about 50 further October candidates are still waiting for a confirming source or an editor’s review. Every row, with its source, is on the October 2026 data page and in the confirmed attacks register.

How were the 25 confirmed?

In two ways, and the difference matters. In 13 incidents the organisation, an official or a filing says in terms that it was ransomware or that systems were encrypted. In the other 12 the organisation confirmed an intrusion or a data theft without naming ransomware, and the link to ransomware is a group’s leak-site listing of the same victim. Brenner Base Tunnel SE, Kissei Shoji, Chugoku Bend, Coopecaja and Mandurah State Emergency Service are in that second set. Both sets meet the dataset’s rule, which needs the victim’s own confirmation in every case; a leak-site claim alone never counts.

Three providers, hundreds of victims

Our dataset counts one row per attacked organisation, which undercounts what happened in October. IDC Frontier said a ransomware attack on 7 October took down its IDCF Cloud East Japan region, used by 495 companies and local governments; Peach Aviation’s itinerary emails were among the casualties, and the company says it has had no contact with the attackers and paid nothing. At GMO Internet, attackers installed malware on up to 26,739 customer servers of the Onamae.com Desktop Cloud service, demanded 8 billion yen and threatened to deploy ransomware on customers’ PCs; GMO refused and offered a $1 million bounty instead. In Argentina, the municipal software vendor Program Consultores (PGM) confirmed bitcoin ransom demands after an attack on 23 October cut tax and payment services for at least 22 councils in five provinces. Three rows, and well over 500 organisations affected.

Which groups had the most confirmed victims?

Everest and The Gentlemen, with three each. Everest’s are Brenner Base Tunnel SE and two Japanese firms, Kissei Shoji and Chugoku Bend; The Gentlemen’s are Santa Barbara Endodontics, Mandurah State Emergency Service and Epichealth Medical Clinics. Qilin (City of Columbia, Bathurst RSL Club), Interlock (Jerome School District, Richmond Public Schools) and INC Ransom (Seetelhotels, Coopecaja) have two each. Seven groups have one: Akira (Erowa), LockBit (Poole Group), Cloak (Medizinisches Zentrum Gleis D), BYOD (UNM Health), Shiba (Oneonta City School District), Black X (enTouch) and Majinahanashi (Magasin du Nord). Six incidents carry no attribution. In every case the name comes from the group’s own leak-site listing, not from the victim.

Who went public first, the gang or the victim?

The gang, more often than not. Of the 19 incidents with a leak-site listing, the group published before any public confirmation in 11, the victim spoke first in seven, and one landed on the same day. The gap was longest at Santa Barbara Endodontics, 21 days, and at the Brenner Base Tunnel, 20 days, which we cover in Everest listed Brenner Base Tunnel 20 days before the news. Nine of the 11 gang-first victims then confirmed only an intrusion or data theft; five of the seven that spoke first called it ransomware themselves.

Which sectors and countries were hit most?

Government leads with five incidents, followed by healthcare with four and technology and education with three each. Finance, retail and services have two each, and manufacturing and construction one each. The incidents span 11 countries: the United States with seven, Japan with five, Australia with four, Switzerland with two, and one each in Germany, France, Denmark, Italy, India, Argentina and Costa Rica. Disclosure rules shape that ranking: US breach-notification law and Japan’s stock-exchange filings push incidents onto the public record faster than most countries’ rules do.

Notable confirmed incidents

• IDC Frontier, Tokyo, Japan, cloud provider, no group named (source)
• GMO Internet, Tokyo, Japan, hosting and cloud, no group named (source)
• Program Consultores (PGM), Argentina, municipal software, no group named (source)
• UNM Health, New Mexico, United States, healthcare, BYOD (source)
• Brenner Base Tunnel SE, Italy and Austria, construction, Everest (source)
• City of Columbia, South Carolina, United States, government, Qilin (source)
• Richmond Public Schools, Virginia, United States, education, Interlock (source)
• Jerome School District, Idaho, United States, education, Interlock (source)
• Epichealth Medical Clinics, Victoria, Australia, healthcare, The Gentlemen (source)
• TG-iPASS, Telangana, India, government, no group named (source)
• Erowa, Lucerne, Switzerland, industrial equipment, Akira (source)
• Magasin du Nord, Copenhagen, Denmark, retail, Majinahanashi (source)

Did any October victim pay?

None has said so. Six of the 25 are recorded as not paying: IDC Frontier, GMO Internet, Jerome School District and the town hall of Verrières-en-Forez, which all said so publicly, plus TG-iPASS and Chugoku Bend. The Town of Bernalillo’s council approved an $82,000 offer to the attackers, but the mayor said no payment had been made when that was reported on 30 October, so it is recorded as unknown, like the other 18. Most victims never say either way, so the public record undercounts payments; our payment-rate analysis explains how far it can be read.

Frequently asked questions

Sources and further reading

• Ransomware attacks in October 2026, the month’s data page
• Confirmed ransomware attacks register, the live list with a source for every incident
• Ransomware attacks in 2026, the year page
• Ransomware statistics
• Ransomware payment rate