EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
Global observatory

Ransomware worldwide

Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.

See the latest cases
Sources up to date Last collection Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Reported cases946matching reports grouped into cases
In the last 24 hours23first public report
Countries involved84652 cases with a known country
Groups in the claims84in the selected period
Where it happens

Countries of reported organizations

652 mapped cases
World map of victim countries stated in public claims

Hover for details. Click a country to zoom in, then drag the map to pan.

The map shows the country of organizations named by the sources.
  1. 0
  2. 1–9
  3. 10–99
  4. 100–999
  5. 1.000–9.999
  6. 10.000+

652 / 946 cases with a usable country · 294 without usable country data.

How it is evolving

Reporting trend

Cases per day · UTC

Date first reported by the sources, which may differ from the attack date. The current period is incomplete.

63 Reporting trend946 reported cases. Values are available in the table below the chart.28/08: 2929/08: 6330/08: 1031/08: 4901/09: 4002/09: 3303/09: 2704/09: 2905/09: 1606/09: 907/09: 5408/09: 3109/09: 4610/09: 2711/09: 1012/09: 2713/09: 1214/09: 6215/09: 3416/09: 3217/09: 2818/09: 4219/09: 1220/09: 1721/09: 5022/09: 3823/09: 5324/09: 4125/09: 2326/09: 2
28/0826/09
View chart values
PeriodReported cases
2026-08-2829
2026-08-2963
2026-08-3010
2026-08-3149
2026-09-0140
2026-09-0233
2026-09-0327
2026-09-0429
2026-09-0516
2026-09-069
2026-09-0754
2026-09-0831
2026-09-0946
2026-09-1027
2026-09-1110
2026-09-1227
2026-09-1312
2026-09-1462
2026-09-1534
2026-09-1632
2026-09-1728
2026-09-1842
2026-09-1912
2026-09-2017
2026-09-2150
2026-09-2238
2026-09-2353
2026-09-2441
2026-09-2523
2026-09-262
Who is claiming responsibility

Most active groups

Group profiles →
  1. The Gentlemen99 10%
  2. Qilin87 9%
  3. audit team44 5%
  4. Akira40 4%
  5. INC Ransom39 4%
  6. Krybit35 4%

Share of cases in the period, by the group named by the sources.

Who is affected

Organization sectors

646 / 946
  1. Manufacturing126 13%
  2. Professional Services85 9%
  3. Technology81 9%
  4. Healthcare68 7%
  5. Other64 7%
  6. Retail & E-Commerce44 5%

Classification reported by the sources. 300 cases without a usable sector.

What is happening

Latest reported cases

1–25 / 946

Open a case to review its sources. A claim does not establish a confirmed compromise.

First reportedOrganisationGroupCountrySectorSources
05:48 UTC https://www.crossettinc.com/ termite Not reported Not reportedRansomLook
00:43 UTC Crossett termite United States Otherransomware.live
21:44 UTC N... leakeddata Not reported Not reportedRansomLook
19:28 UTC N... SilentRansomGroup Not reported Not reportedransomware.live
19:27 UTC S... SilentRansomGroup Not reported Not reportedransomware.live
19:01 UTC GE Vernova Inc. metaencryptor United States Energy & Utilitiesransomware.live
19:00 UTC PKF Hadiwinata metaencryptor Indonesia Professional Servicesransomware.live
19:00 UTC Platinum Healthcare Staffing metaencryptor United States Healthcareransomware.live
16:29 UTC Securitas Group2 aggregated matches everest Sweden Professional ServicesRansomLook · ransomware.live
16:28 UTC Morula IVF3 aggregated matches everest South Africa HealthcareRansomLook · ransomware.live
16:24 UTC Electrolux & Ontrac2 aggregated matches emperador Not reported ManufacturingRansomLook · ransomware.live
15:53 UTC Tobin & Company3 aggregated matches Wallstreet United States Financial ServicesRansomLook · ransomware.live
15:53 UTC Ar Valve Resources3 aggregated matches Wallstreet United Kingdom Energy & UtilitiesRansomLook · ransomware.live
15:53 UTC GTFM2 aggregated matches Wallstreet United States Not reportedRansomLook · ransomware.live
15:52 UTC Beatus Cartons3 aggregated matches Wallstreet United Kingdom ManufacturingRansomLook · ransomware.live
15:34 UTC Reliance Audit2 aggregated matches everest Not reported Professional ServicesRansomLook · ransomware.live
15:33 UTC UNIRITA3 aggregated matches everest Japan TechnologyRansomLook · ransomware.live
15:33 UTC CENELEC2 aggregated matches everest Belgium Professional ServicesRansomLook · ransomware.live
15:32 UTC ETS2 aggregated matches everest Not reported EducationRansomLook · ransomware.live
15:25 UTC Breast Implant Center of Hawaii3 aggregated matches Wallstreet United States HealthcareRansomLook · ransomware.live
13:24 UTC Majani Insurance Brokers2 aggregated matches Vexy Kenya Financial ServicesRansomLook · ransomware.live
12:48 UTC Iberia Compositech Manufacturing2 aggregated matches Qilin Spain ManufacturingRansomLook · ransomware.live
11:36 UTC FTAPI Software The Gentlemen Not reported Not reportedRansomLook
10:33 UTC pharma5.ma2 aggregated matches INC Ransom Morocco HealthcareRansomLook · ransomware.live
03:21 UTC TapClicks (marketing analytics platform) N0n United States Technologyransomware.live
Sources, coverage and methodology

This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.

Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.

1628 source reports for 946 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.

RansomLookLast successful collection
ransomware.liveLast successful collection

General articles, group profiles and technical portal checks are excluded from the counts.

View onion portal diagnostics →