EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
Global observatory

Ransomware worldwide

Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.

See the latest cases
Sources up to date Last collection Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Reported cases951matching reports grouped into cases
In the last 24 hours25first public report
Countries involved84658 cases with a known country
Groups in the claims84in the selected period
Where it happens

Countries of reported organizations

658 mapped cases
World map of victim countries stated in public claims

Hover for details. Click a country to zoom in, then drag the map to pan.

The map shows the country of organizations named by the sources.
  1. 0
  2. 1–9
  3. 10–99
  4. 100–999
  5. 1.000–9.999
  6. 10.000+

658 / 951 cases with a usable country · 293 without usable country data.

How it is evolving

Reporting trend

Cases per day · UTC

Date first reported by the sources, which may differ from the attack date. The current period is incomplete.

63 Reporting trend951 reported cases. Values are available in the table below the chart.28/08: 2929/08: 6330/08: 1031/08: 4901/09: 4002/09: 3303/09: 2704/09: 2905/09: 1606/09: 907/09: 5408/09: 3109/09: 4610/09: 2711/09: 1012/09: 2713/09: 1214/09: 6215/09: 3416/09: 3217/09: 2818/09: 4219/09: 1220/09: 1721/09: 5022/09: 3823/09: 5324/09: 4125/09: 2326/09: 7
28/0826/09
View chart values
PeriodReported cases
2026-08-2829
2026-08-2963
2026-08-3010
2026-08-3149
2026-09-0140
2026-09-0233
2026-09-0327
2026-09-0429
2026-09-0516
2026-09-069
2026-09-0754
2026-09-0831
2026-09-0946
2026-09-1027
2026-09-1110
2026-09-1227
2026-09-1312
2026-09-1462
2026-09-1534
2026-09-1632
2026-09-1728
2026-09-1842
2026-09-1912
2026-09-2017
2026-09-2150
2026-09-2238
2026-09-2353
2026-09-2441
2026-09-2523
2026-09-267
Who is claiming responsibility

Most active groups

Group profiles →
  1. The Gentlemen100 11%
  2. Qilin87 9%
  3. audit team44 5%
  4. Akira40 4%
  5. INC Ransom39 4%
  6. Krybit35 4%

Share of cases in the period, by the group named by the sources.

Who is affected

Organization sectors

652 / 951
  1. Manufacturing128 13%
  2. Professional Services86 9%
  3. Technology82 9%
  4. Healthcare68 7%
  5. Other65 7%
  6. Retail & E-Commerce45 5%

Classification reported by the sources. 299 cases without a usable sector.

What is happening

Latest reported cases

26–50 / 951

Open a case to review its sources. A claim does not establish a confirmed compromise.

First reportedOrganisationGroupCountrySectorSources
13:24 UTC Majani Insurance Brokers2 aggregated matches Vexy Kenya Financial ServicesRansomLook · ransomware.live
12:48 UTC Iberia Compositech Manufacturing2 aggregated matches Qilin Spain ManufacturingRansomLook · ransomware.live
11:36 UTC FTAPI Software2 aggregated matches The Gentlemen United States TechnologyRansomLook · ransomware.live
10:33 UTC pharma5.ma2 aggregated matches INC Ransom Morocco HealthcareRansomLook · ransomware.live
03:21 UTC TapClicks (marketing analytics platform) N0n United States Technologyransomware.live
22:23 UTC Armada Credit Bureau Spirals Uganda Financial Servicesransomware.live
20:01 UTC efada.sa2 aggregated matches Krybit Saudi Arabia OtherRansomLook · ransomware.live
18:01 UTC NEAD Pro2 aggregated matches rhysida Not reported Not reportedRansomLook · ransomware.live
17:58 UTC bnlawmacau.com www.bn-ip.com2 aggregated matches INC Ransom Macao Professional ServicesRansomLook · ransomware.live
17:35 UTC Westside GI2 aggregated matches pear United States HealthcareRansomLook · ransomware.live
17:35 UTC Martin Lawrence Galleries2 aggregated matches pear United States Retail & E-CommerceRansomLook · ransomware.live
17:35 UTC Indroj Medical Group Inc.2 aggregated matches pear United States HealthcareRansomLook · ransomware.live
17:35 UTC corisricambi.it2 aggregated matches LockBit 5 Italy OtherRansomLook · ransomware.live
17:35 UTC winfashion DragonForce Not reported Not reportedRansomLook
17:15 UTC Applied Composites2 aggregated matches Storm United States ManufacturingRansomLook · ransomware.live
17:15 UTC Magna Legal Services2 aggregated matches Storm United States Professional ServicesRansomLook · ransomware.live
17:08 UTC welgenone.com2 aggregated matches INC Ransom United States HealthcareRansomLook · ransomware.live
17:07 UTC ukbjja.org2 aggregated matches INC Ransom United Kingdom Not reportedRansomLook · ransomware.live
15:07 UTC Prater & Ridley Attorneys At Law2 aggregated matches Wallstreet United States Professional ServicesRansomLook · ransomware.live
14:42 UTC agiliance.fr zawoo Not reported Not reportedRansomLook
14:42 UTC HEOLIS zawoo Not reported Not reportedRansomLook
14:42 UTC www.francare.com zawoo Not reported Not reportedRansomLook
14:42 UTC amb-pvc.com zawoo Not reported Not reportedRansomLook
14:28 UTC Catholic University of El Salvador2 aggregated matches Wallstreet El Salvador EducationRansomLook · ransomware.live
14:24 UTC Dao Group2 aggregated matches Qilin Not reported OtherRansomLook · ransomware.live
Sources, coverage and methodology

This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.

Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.

1658 source reports for 951 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.

RansomLookLast successful collection
ransomware.liveLast successful collection

General articles, group profiles and technical portal checks are excluded from the counts.

View onion portal diagnostics →