Ransomtracker · year archive
Ransomware attacks in 2026: 8,553 victims listed on leak sites
In 2026, ransomware operators listed 8,553 victims on their leak sites so far this year, to 15 October 2026, across 168 operations and 131 countries where a location could be read from the listing. That is 28.8% more than the same period of 2025 (6,640). Qilin was the most active operator with 1,071 listings (12.5% of the year), and August was the busiest month with 1,223. Every entry is an operator claim as published on a leak site, not a verified incident.
By month
Victims listed per month in 2026
Stacked by the five operators with the most listings in the year. The current month is partial and shown lighter.
| Month | Listings | vs previous month | Most active operator |
|---|---|---|---|
| January 2026 | 789 | – | Qilin 109 |
| February 2026 | 831 | +42 | Qilin 116 |
| March 2026 | 931 | +100 | Qilin 141 |
| April 2026 | 834 | −97 | Qilin 112 |
| May 2026 | 764 | −70 | Qilin 100 |
| June 2026 | 842 | +78 | The Gentlemen 125 |
| July 2026 | 845 | +3 | The Gentlemen 139 |
| August 2026 | 1,223 | +378 | Qilin 165 |
| September 2026 | 968 | −255 | The Gentlemen 106 |
| October 2026 (partial) | 526 | −442 | N0N 69 |
Busiest single day: 15 June 2026 with 131 listings. Listings were recorded on 287 of the 288 days so far. Masked or placeholder victim names: 275.
Operators
Which ransomware groups were most active in 2026?
The 25 operators with the most leak-site listings so far this year. Names link to full operator profiles.
| # | Operator | Listings | Share | Last listing |
|---|---|---|---|---|
| 1 | Qilin | 1,071 | 12.5% | 15 Oct |
| 2 | The Gentlemen | 944 | 11.0% | 11 Oct |
| 3 | Akira | 410 | 4.8% | 15 Oct |
| 4 | INC Ransom | 380 | 4.4% | 14 Oct |
| 5 | DragonForce | 330 | 3.9% | 14 Oct |
| 6 | NightSpire | 284 | 3.3% | 15 Oct |
| 7 | LockBit 5 | 271 | 3.2% | 15 Oct |
| 8 | Cl0p | 246 | 2.9% | 23 Sep |
| 9 | Play | 216 | 2.5% | 13 Oct |
| 10 | Coinbase Cartel | 177 | 2.1% | 31 Aug |
| 11 | SafePay | 173 | 2.0% | 12 Oct |
| 12 new | Krybit | 163 | 1.9% | 4 Oct |
| 13 | Everest | 149 | 1.7% | 12 Oct |
| 14 new | Shinyhunters | 136 | 1.6% | 2 Oct |
| 15 new | Deadlock | 108 | 1.3% | 14 Oct |
| 16 | Genesis | 95 | 1.1% | 1 Oct |
| 17 | Nova | 95 | 1.1% | 25 Jul |
| 18 | PayoutsKing | 88 | 1.0% | 14 Oct |
| 19 new | Storm | 86 | 1.0% | 12 Oct |
| 20 | Leakeddata | 86 | 1.0% | 9 Oct |
| 21 | Sinobi | 86 | 1.0% | 8 May |
| 22 new | N0N | 85 | 1.0% | 15 Oct |
| 23 | Direwolf | 80 | 0.9% | 13 Oct |
| 24 new | Payload | 76 | 0.9% | 8 Oct |
| 25 | Pear | 75 | 0.9% | 1 Oct |
new marks an operator whose first listing in the Ransomtracker index falls in 2026. Status: live, a listing within 30 days · dormant, 30 to 180 days · dark, nothing for 180 days. Rebrands (Conti to Black Basta, Royal to BlackSuit and so on) are counted under the name on the leak site at the time; lineage is annotated on the profiles.
Countries
Where were the victims listed in 2026?
Victim country where the operator’s own text, the victim’s domain or a recognisable city gave it away.
How much of the year could be placed
A country was identified for 38.1% of the 8,553 listings; 5,297 name no location and are not in the ranking. 131 countries appear at least once. Operators who write descriptions are over-represented, so read the ranking as a floor, not a census.
The live tracker carries the trailing-12-month map; verified incidents by country are on the confirmed attacks pages.
Context
How 2026 compares with other years
Leak-site listings per year in the Ransomtracker index. Earlier years are less complete: coverage of leak sites has widened every year, so part of the growth is measurement.
FAQ
Frequently asked questions
How many ransomware attacks were there in 2026?
Ransomtracker recorded 8,553 victims listed on ransomware leak sites in 2026 so far, to 15 October 2026. These are operator claims as published, so they overstate confirmed incidents (some are duplicated, inflated or fabricated) and understate the real total (victims who pay quietly are never listed).
Which ransomware group was most active in 2026?
Qilin, with 1,071 listings, 12.5% of all leak-site victims so far in 2026, ahead of The Gentlemen (944) and Akira (410).
Which month had the most ransomware attacks in 2026?
August 2026, with 1,223 leak-site listings, 165 of them by Qilin.
Which country had the most ransomware victims in 2026?
The United States, with 897 identified victims, 27.5% of the listings that could be placed in a country. A country could be read for 38.1% of listings, so the ranking is indicative.
Were there more ransomware attacks in 2026 than in 2025?
Yes: 8,553 listings so far in 2026 against 6,640 in the same period of 2025, a change of +28.8%.
Are these confirmed ransomware attacks?
No. Ransomtracker indexes what operators publish on their leak sites; nothing here is verified by Ransomnews. The separately maintained confirmed ransomware attacks dataset holds incidents corroborated against breach notifications, filings and press reports.
Data
Download and cite
Every listing behind this page is available as CSV (2026, one row per listing) and the figures above as JSON; a monthly summary CSV covers every year since 2022. Cite as Ransomnews Ransomtracker, with a link to this page. Figures recalculate from the live index and this page refreshes every 20 minutes; generated 15 October 2026 17:50 UTC.
Method: the collector parses each victim listing as operators publish it and records the organisation named, the operator, the listing time and the operator’s description. Country is a best-effort reading of that text and the victim’s domain. Source data: RansomLook (CC BY 4.0), aggregated, enriched and adapted by Ransomnews. The full methodology and caveats are on the tracker page.