Global observatory
See the latest cases
Ransomware worldwide
Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.
Sources up to date
Last collection
Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Where it happens
76 mapped casesCountries of reported organizations
Hover for details. Click a country to zoom in, then drag the map to pan.
- Reported cases
- 19
- Named groups
- 1
- Latest report
- 24/09/2026
Named groups
- Qilin19
- Reported cases
- 6
- Named groups
- 1
- Latest report
- 25/09/2026
Named groups
- Qilin6
- Reported cases
- 5
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- Qilin5
- Reported cases
- 5
- Named groups
- 1
- Latest report
- 24/09/2026
Named groups
- Qilin5
- Reported cases
- 5
- Named groups
- 1
- Latest report
- 24/09/2026
Named groups
- Qilin5
- Reported cases
- 5
- Named groups
- 1
- Latest report
- 24/09/2026
Named groups
- Qilin5
- Reported cases
- 4
- Named groups
- 1
- Latest report
- 22/09/2026
Named groups
- Qilin4
- Reported cases
- 2
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- Qilin2
- Reported cases
- 2
- Named groups
- 1
- Latest report
- 20/09/2026
Named groups
- Qilin2
- Reported cases
- 2
- Named groups
- 1
- Latest report
- 22/09/2026
Named groups
- Qilin2
- Reported cases
- 2
- Named groups
- 1
- Latest report
- 21/09/2026
Named groups
- Qilin2
- Reported cases
- 2
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- Qilin2
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 14/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 20/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 24/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 28/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 31/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 21/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 30/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 29/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 29/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 05/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 30/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 16/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 07/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 20/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 20/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- Qilin1
- 0
- 1–9
- 10–99
- 100–999
- 1.000–9.999
- 10.000+
76 / 87 cases with a usable country · 11 without usable country data.
How it is evolving
Cases per day · UTCReporting trend
Date first reported by the sources, which may differ from the attack date. The current period is incomplete.
8
28/0826/09
View chart values
| Period | Reported cases |
|---|---|
| 2026-08-28 | 7 |
| 2026-08-29 | 8 |
| 2026-08-30 | 4 |
| 2026-08-31 | 2 |
| 2026-09-01 | 1 |
| 2026-09-02 | 3 |
| 2026-09-03 | 1 |
| 2026-09-04 | 2 |
| 2026-09-05 | 7 |
| 2026-09-06 | 0 |
| 2026-09-07 | 2 |
| 2026-09-08 | 1 |
| 2026-09-09 | 2 |
| 2026-09-10 | 0 |
| 2026-09-11 | 1 |
| 2026-09-12 | 0 |
| 2026-09-13 | 2 |
| 2026-09-14 | 6 |
| 2026-09-15 | 7 |
| 2026-09-16 | 5 |
| 2026-09-17 | 4 |
| 2026-09-18 | 5 |
| 2026-09-19 | 0 |
| 2026-09-20 | 4 |
| 2026-09-21 | 2 |
| 2026-09-22 | 3 |
| 2026-09-23 | 1 |
| 2026-09-24 | 6 |
| 2026-09-25 | 1 |
| 2026-09-26 | 0 |
Who is claiming responsibility
Group profiles →Most active groups
Share of cases in the period, by the group named by the sources.
Who is affected
76 / 87Organization sectors
- Manufacturing19 22%
- Technology10 11%
- Other9 10%
- Professional Services7 8%
- Retail & E-Commerce6 7%
- Agriculture and Food Production5 6%
Classification reported by the sources. 11 cases without a usable sector.
What is happening
1–25 / 87Latest reported cases
Open a case to review its sources. A claim does not establish a confirmed compromise.
| First reported | Organisation | Group | Country | Sector | Sources |
|---|---|---|---|---|---|
| 12:48 UTC | Iberia Compositech Manufacturing2 aggregated matches | Qilin | Spain | Manufacturing | RansomLook · ransomware.live |
| 14:24 UTC | Dao Group2 aggregated matches | Qilin | Not reported | Other | RansomLook · ransomware.live |
| 14:23 UTC | All Tech Machine & Engineering2 aggregated matches | Qilin | United States | Manufacturing | RansomLook · ransomware.live |
| 14:22 UTC | Inversiones Bolívar2 aggregated matches | Qilin | Colombia | Financial Services | RansomLook · ransomware.live |
| 14:22 UTC | Zig Inge Group2 aggregated matches | Qilin | Australia | Not reported | RansomLook · ransomware.live |
| 13:46 UTC | Agora coopérative agricole2 aggregated matches | Qilin | France | Agriculture and Food Production | RansomLook · ransomware.live |
| 13:45 UTC | GDM Pipelines2 aggregated matches | Qilin | United Kingdom | Energy & Utilities | RansomLook · ransomware.live |
| 11:51 UTC | Inkript2 aggregated matches | Qilin | Not reported | Technology | RansomLook · ransomware.live |
| 13:23 UTC | The Fifty/502 aggregated matches | Qilin | United States | Not reported | RansomLook · ransomware.live |
| 11:12 UTC | Textile City2 aggregated matches | Qilin | Canada | Manufacturing | RansomLook · ransomware.live |
| 10:18 UTC | Columbus Informatica2 aggregated matches | Qilin | Italy | Technology | RansomLook · ransomware.live |
| 17:22 UTC | Telrad Networks2 aggregated matches | Qilin | Israel | Technology | RansomLook · ransomware.live |
| 08:01 UTC | IKEGAMI TSUSHINKI COMPANY LIMITED2 aggregated matches | Qilin | Japan | Manufacturing | RansomLook · ransomware.live |
| 12:15 UTC | Zorlu Holding2 aggregated matches | Qilin | Turkey | Manufacturing | RansomLook · ransomware.live |
| 12:14 UTC | ShopDunk2 aggregated matches | Qilin | Thailand | Retail & E-Commerce | RansomLook · ransomware.live |
| 12:13 UTC | KMLS2 aggregated matches | Qilin | Germany | Not reported | RansomLook · ransomware.live |
| 12:13 UTC | Touring Club Suisse2 aggregated matches | Qilin | Switzerland | Transportation | RansomLook · ransomware.live |
| 10:12 UTC | Ascend Com2 aggregated matches | Qilin | Singapore | Technology | RansomLook · ransomware.live |
| 10:11 UTC | Ceres Tolvas2 aggregated matches | Qilin | Argentina | Agriculture and Food Production | RansomLook · ransomware.live |
| 10:10 UTC | Futuro Forestal2 aggregated matches | Qilin | Chile | Agriculture and Food Production | RansomLook · ransomware.live |
| 10:09 UTC | Grupo Juste2 aggregated matches | Qilin | Mexico | Other | RansomLook · ransomware.live |
| 10:09 UTC | Inland and Offshore Contractors2 aggregated matches | Qilin | Trinidad and Tobago | Energy & Utilities | RansomLook · ransomware.live |
| 20:58 UTC | Vigatec2 aggregated matches | Qilin | Germany | Technology | RansomLook · ransomware.live |
| 19:03 UTC | Invincible GG2 aggregated matches | Qilin | Not reported | Technology | RansomLook · ransomware.live |
| 16:03 UTC | Techwise2 aggregated matches | Qilin | Argentina | Technology | RansomLook · ransomware.live |
Sources, coverage and methodology
This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.
Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.
172 source reports for 87 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.
RansomLookLast successful collection
ransomware.liveLast successful collection
General articles, group profiles and technical portal checks are excluded from the counts.
View onion portal diagnostics →