Global observatory
See the latest cases
Ransomware worldwide
Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.
Sources up to date
Last collection
Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Where it happens
66 mapped casesCountries of reported organizations
Hover for details. Click a country to zoom in, then drag the map to pan.
- Reported cases
- 16
- Named groups
- 14
- Latest report
- 26/09/2026
Named groups
- wallstreet2
- INC Ransom2
- payoutsking1
- Qilin1
- termite1
- Reported cases
- 5
- Named groups
- 4
- Latest report
- 20/09/2026
Named groups
- audit team2
- Qilin1
- SilentRansomGroup1
- Rhysida1
- Reported cases
- 5
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- audit team5
- Reported cases
- 4
- Named groups
- 4
- Latest report
- 19/09/2026
Named groups
- Arcus Media1
- Vexy1
- Dire Wolf1
- unsafe1
- Reported cases
- 4
- Named groups
- 4
- Latest report
- 24/09/2026
Named groups
- INC Ransom1
- clop1
- The Gentlemen1
- chaos1
- Reported cases
- 3
- Named groups
- 3
- Latest report
- 09/09/2026
Named groups
- audit team1
- SafePay1
- LockBit 51
- Reported cases
- 3
- Named groups
- 2
- Latest report
- 20/09/2026
Named groups
- audit team2
- Qilin1
- Reported cases
- 2
- Named groups
- 1
- Latest report
- 24/09/2026
Named groups
- Qilin2
- Reported cases
- 2
- Named groups
- 2
- Latest report
- 02/09/2026
Named groups
- INC Ransom1
- play1
- Reported cases
- 2
- Named groups
- 2
- Latest report
- 23/09/2026
Named groups
- clop1
- emperador1
- Reported cases
- 2
- Named groups
- 2
- Latest report
- 23/09/2026
Named groups
- medusalocker1
- The Gentlemen1
- Reported cases
- 2
- Named groups
- 2
- Latest report
- 09/09/2026
Named groups
- audit team1
- black x1
- Reported cases
- 2
- Named groups
- 2
- Latest report
- 22/09/2026
Named groups
- Booba Project1
- threeam1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 07/09/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 14/09/2026
Named groups
- LockBit 51
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 14/09/2026
Named groups
- The Gentlemen1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 12/09/2026
Named groups
- Krybit1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 14/09/2026
Named groups
- The Gentlemen1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 12/09/2026
Named groups
- emperador1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 10/09/2026
Named groups
- audit team1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 30/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 29/08/2026
Named groups
- Qilin1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 29/08/2026
Named groups
- LockBit 51
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 23/09/2026
Named groups
- clop1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 07/09/2026
Named groups
- The Gentlemen1
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 31/08/2026
Named groups
- crypto241
- Reported cases
- 1
- Named groups
- 1
- Latest report
- 18/09/2026
Named groups
- Krybit1
- 0
- 1–9
- 10–99
- 100–999
- 1.000–9.999
- 10.000+
66 / 299 cases with a usable country · 233 without usable country data.
How it is evolving
Cases per day · UTCReporting trend
Date first reported by the sources, which may differ from the attack date. The current period is incomplete.
28
28/0826/09
View chart values
| Period | Reported cases |
|---|---|
| 2026-08-28 | 7 |
| 2026-08-29 | 28 |
| 2026-08-30 | 3 |
| 2026-08-31 | 12 |
| 2026-09-01 | 10 |
| 2026-09-02 | 12 |
| 2026-09-03 | 11 |
| 2026-09-04 | 9 |
| 2026-09-05 | 0 |
| 2026-09-06 | 3 |
| 2026-09-07 | 12 |
| 2026-09-08 | 8 |
| 2026-09-09 | 25 |
| 2026-09-10 | 7 |
| 2026-09-11 | 3 |
| 2026-09-12 | 6 |
| 2026-09-13 | 4 |
| 2026-09-14 | 15 |
| 2026-09-15 | 7 |
| 2026-09-16 | 14 |
| 2026-09-17 | 8 |
| 2026-09-18 | 2 |
| 2026-09-19 | 7 |
| 2026-09-20 | 7 |
| 2026-09-21 | 25 |
| 2026-09-22 | 19 |
| 2026-09-23 | 15 |
| 2026-09-24 | 11 |
| 2026-09-25 | 4 |
| 2026-09-26 | 5 |
Who is claiming responsibility
Group profiles →Most active groups
Share of cases in the period, by the group named by the sources.
Who is affected
0 / 299Organization sectors
- No sector reported by the sources for these filters.
Classification reported by the sources. 299 cases without a usable sector.
What is happening
1–25 / 299Latest reported cases
Open a case to review its sources. A claim does not establish a confirmed compromise.
| First reported | Organisation | Group | Country | Sector | Sources |
|---|---|---|---|---|---|
| 12:35 UTC | Corona Corporation | metaencryptor | Not reported | Not reported | RansomLook |
| 12:35 UTC | FactoryFive | metaencryptor | Not reported | Not reported | RansomLook |
| 12:35 UTC | Aquamar Inc | metaencryptor | Not reported | Not reported | RansomLook |
| 08:55 UTC | M****n | payoutsking | United States | Not reported | ransomware.live |
| 05:48 UTC | https://www.crossettinc.com/ | termite | Not reported | Not reported | RansomLook |
| 21:44 UTC | N... | leakeddata | Not reported | Not reported | RansomLook |
| 19:28 UTC | N... | SilentRansomGroup | Not reported | Not reported | ransomware.live |
| 19:27 UTC | S... | SilentRansomGroup | Not reported | Not reported | ransomware.live |
| 15:53 UTC | GTFM2 aggregated matches | Wallstreet | United States | Not reported | RansomLook · ransomware.live |
| 18:01 UTC | NEAD Pro2 aggregated matches | rhysida | Not reported | Not reported | RansomLook · ransomware.live |
| 17:35 UTC | winfashion | DragonForce | Not reported | Not reported | RansomLook |
| 17:07 UTC | ukbjja.org2 aggregated matches | INC Ransom | United Kingdom | Not reported | RansomLook · ransomware.live |
| 14:42 UTC | agiliance.fr | zawoo | Not reported | Not reported | RansomLook |
| 14:42 UTC | HEOLIS | zawoo | Not reported | Not reported | RansomLook |
| 14:42 UTC | www.francare.com | zawoo | Not reported | Not reported | RansomLook |
| 14:42 UTC | amb-pvc.com | zawoo | Not reported | Not reported | RansomLook |
| 14:22 UTC | Zig Inge Group2 aggregated matches | Qilin | Australia | Not reported | RansomLook · ransomware.live |
| 12:48 UTC | HEC Group | DragonForce | Not reported | Not reported | RansomLook |
| 10:24 UTC | ENKEI******* | The Gentlemen | Not reported | Not reported | RansomLook |
| 08:44 UTC | Final statement re PSA2 aggregated matches | shinyhunters | Not reported | Not reported | RansomLook · ransomware.live |
| 19:35 UTC | M****n | payoutsking | Not reported | Not reported | RansomLook |
| 19:20 UTC | Abtach Ltd. | Barracuda | Not reported | Not reported | ransomware.live |
| 17:33 UTC | PRESS RELEASE RE PSA | shinyhunters | Not reported | Not reported | RansomLook |
| 16:28 UTC | Apollo 21 – Quality Truck, Bus & Trailer Spare Parts South Africa | blacklocks | Not reported | Not reported | RansomLook |
| 14:36 UTC | SAUL-ORG.UK2 aggregated matches | clop | United Kingdom | Not reported | RansomLook · ransomware.live |
Sources, coverage and methodology
This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.
Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.
368 source reports for 299 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.
RansomLookLast successful collection
ransomware.liveLast successful collection
General articles, group profiles and technical portal checks are excluded from the counts.
View onion portal diagnostics →