Close Menu
Cover: Who got listed today? beside a 14-day bar strip of ransomware leak-site listings per day with today highlighted, from the Ransomnews Ransomtracker daily digest

Ransomware attacks today

Ransomtracker · daily digest

Ransomware attacks today

As of 15 October 2026, 18:51 UTC, 34 organisations have been listed on ransomware leak sites in the last 24 hours by 12 operators, led by The Seven Deadly Sins (7), Iah647 (6), Qilin (5). Yesterday closed at 22; the seven-day average is 39.0 a day, and 526 have been listed so far in October, 8,553 in 2026. Every entry is an operator claim as published, not a verified incident.

34Victims, last 24 hours
22Yesterday, 14 Oct
39.0Seven-day average
526October so far
12Operators posting today

Live index · newest listing 3h ago · this page refreshes every 15 minutes

Last 24 hours

Who was listed on a ransomware leak site today?

Newest first, exactly as the operators posted them. Click an operator for its profile and history.

ListedVictimOperatorCountryWhat the operator posted
3h agoCradlewise Inc.The Seven Deadly Sinsnot statedcradlewise.com Company value $26M raised · ~$14M/yr rev Rows exfiltrated 3.2M+ Affected 43K baby registries · parent emails · addresses · IoT PEM keys · Klaviyo
3h agoHospital Sírio-LibanêsThe Seven Deadly Sinsnot statedhsl.org.br Company value $750M est. Rows exfiltrated 3.5M+ Affected Appointments · telessaúde · PROADI · DATASUS · FHIR patients · SOAP notes · LGPD PHI No cont
3h agoGlobeia Inc.The Seven Deadly Sinsnot statedglobeia.com Company value $2.0M est. · compliance SaaS Rows exfiltrated 920K+ Affected FBI/RCMP applicants · SSN · passport paths · bank details · Strapi admin
3h agoVerano Holdings Corp.The Seven Deadly Sinsnot statedverano.com Company value ~$1.2B mkt cap · public MSO Rows exfiltrated 2.4M+ Affected Customer emails/phones · loyalty tiers · employee discount logs · invoice h
3h agoHarness Inc.The Seven Deadly Sinsnot statedharness.io Company value ~$5B val · DevOps CI/CD Rows exfiltrated 2.5M+ Affected Salesforce leads/contacts · enterprise emails · phones · LinkedIn · pipeline no
3h agoiHeartJaneThe Seven Deadly Sinsnot statediheartjane.com Company value $400M+ raised · cannabis marketplace Rows exfiltrated 19M+ Affected Salesforce Case/Contact/Account · dispensary PII · brand SKUs ·
3h agoCanva Pty LtdThe Seven Deadly SinsAustraliacanva.com Company value ~$40B val · design platform Rows exfiltrated 200M+ Affected Salesforce 2M+ CRM records · enterprise licenses · order PDFs · platform war
3h agomiddlebyIah647not statedstatus: public | hosting: preparing…
3h agosunshine-millsIah647not statedstatus: public | hosting: preparing…
3h agoSvd (Sun Valley Dairy)AkiraUnited StatesSun Valley Dairy is a Truck Transportation, Grocery, and Retail company located in Keizer, Oregon with $65.2 million in revenue and 19 employees.We will upload
3h agoVidekAkiranot statedVidek is a leading global provider of vision-based print verification systems, inserter input and output scanning systems, and data management software.We will
3h agoBoyle, Pecharich, Cline, Whittington and StallingsAkiraUnited StatesThis law firm has been serving clients in Arizona since 1950, specializing in various legal areas including business law, real estate law, probate, trusts, esta
4h agoHocon GasQilinnot statedElectricity, Oil & Gas
4h agoHyperGenQilinnot statedBusiness Services
4h agoChattanooga Shooting SuppliesQilinUnited StatesRetail · Pennsylvania
4h agoCommune Du TamponQilinnot statedGovernment
4h agoBrame TelecomQilinnot statedBusiness Services
4h agohensleyIah647not statedstatus: public | hosting: preparing…
5h agoEnchanted Fine JewelleryVexynot statedenchantedfinejewellery.in
5h agobuckleIah647not statedstatus: public | hosting: preparing…
5h agocamden-livingIah647not statedstatus: public | hosting: preparing…
7h agoS*o**n* Public Schools maskedNightSpirenot stated
8h agoAmity University DubaiBlack Nevasnot stated
10h agoMPI LTDAEmperadorColombiaColombian asphalt company. The company has been operating in the field of asphalt materials since 1974. It produces ordinary bitumen, asphalt with polymer addit
10h agoAlma Center Servizi Medicali S.r.l.Space BearsItalyAlma Center is a private multi-specialty diagnostic and outpatient medical center based in Mariglianella (province of Naples, Campania, Italy). Founded in 1984

Listings published in the last 24 hours, newest first. Country is only given where the operator stated one, a domain gave it away or a city could be matched; masked names are shown as the operator posted them.

Last 14 days

Is today busy or quiet?

Victims listed per day, UTC. Today is partial and shown lighter; leak sites post most heavily on weekday afternoons and evenings UTC.

020406080100Fri 2 Oct: 32 listings322 OctSat 3 Oct: 9 listings93 OctSun 4 Oct: 14 listings144 OctMon 5 Oct: 41 listings415 OctTue 6 Oct: 45 listings456 OctWed 7 Oct: 40 listings407 OctThu 8 Oct: 26 listings268 OctFri 9 Oct: 38 listings389 OctSat 10 Oct: 18 listings1810 OctSun 11 Oct: 28 listings2811 OctMon 12 Oct: 83 listings8312 OctTue 13 Oct: 58 listings5813 OctWed 14 Oct: 22 listings2214 OctThu 15 Oct: 41 listings so far4115 Oct

Operators

Which ransomware groups are posting right now?

Operators with a listing in the last 24 hours, and the 30-day leaders for context.

Posting in the last 24 hours

  1. The Seven Deadly Sins7
  2. Iah6476
  3. Qilin5
  4. N0N5
  5. Akira3
  6. Space Bears2
  7. Vexy1
  8. NightSpire1
  9. Black Nevas1
  10. Emperador1
  11. PayoutsKing1
  12. Eclipse1

Most active over 30 days

  1. The Gentlemen100
  2. Qilin87
  3. N0N85
  4. Killsec346
  5. INC Ransom43

82 operators posted in the last 30 days. Full leaderboard with trends on the tracker.

Countries identified in today's listings: United States (8), Australia (1), Colombia (1), Italy (1), Netherlands (1), Taiwan (1). Country is only given where the operator stated one, a domain gave it away or a city could be matched.

FAQ

Frequently asked questions

How many ransomware attacks happened today?

In the last 24 hours, 34 organisations were named on ransomware leak sites, against 22 yesterday and a seven-day average of 39.0. The count is what operators publish; victims who pay before being listed, or who are hit by groups without a leak site, never appear.

Which ransomware group is most active today?

The Seven Deadly Sins posted the most listings in the last 24 hours (7). Over the last 30 days the most active operator is The Gentlemen with 100.

Is a leak-site listing the same as a confirmed attack?

No. A listing means an operator claims to have breached the organisation and is pressuring it to pay. Some claims are inflated, duplicated across rebrands or fabricated. Ransomnews keeps a separate, human-verified confirmed ransomware attacks dataset corroborated against notifications, filings and press reports.

How often is this page updated?

The collector parses leak sites continuously and the figures on this page recalculate every 15 minutes; the time stamp at the top says when. The live tracker carries the same data with search, 24 months of trends and a country map, and each year has its own archive page.

Can I check whether a specific company was listed?

Yes: search the organisation name on the tracker, or filter the index by year and operator. Masked names (for example "Company #69") are shown exactly as the operator posted them.

Data

Download and cite

The latest listings are available as JSON, the headline figures as summary JSON, and every listing of the year as CSV. Cite as Ransomnews Ransomtracker, with a link to this page and the time stamp. Source data: RansomLook (CC BY 4.0), aggregated, enriched and adapted by Ransomnews.