Ransomware: who gets hit, how often, and by whom - 2025/26

Between January 2025 and September 2026, 214 ransomware groups claimed 16,326 victims on their leak sites. Each claim is a company, a hospital or a local authority that a group says it has hacked, often with a countdown before the stolen data goes online.

These lists tell three stories: a volume that doubled in a year, a threat spreading across more groups, and a new player, The Gentlemen, that strikes outside the United States first. Behind the curves are also the arrests, internal leaks and score-settling between groups that make and unmake ransomware brands.

These figures are not exhaustive. They only show the victims that groups choose to expose: a victim that pays quietly never shows up, and some groups pad their lists or repost old victims. They measure visible extortion, not every attack.

Volume doubled in a year

How to read it: each row is a quarter, each column a sector. A bubble's area is proportional to the number of claims; the dark dot in the middle stands for victims located in France. The red bubble is the largest in the series.

Q3 2026 is the busiest quarter in the series, with 3,427 claims, twice as many as a year earlier (1,675). The rise hits all eleven sectors at once: this is not a targeted campaign, it is the overall level of activity going up.

Manufacturing comes first every quarter. It accounts for just over one in five claims whose sector is known. A stopped plant costs money every hour, which pushes victims to pay fast. Technology and retail follow.

Retail, transport and healthcare are rising fastest. Retail tripled in a year (321 claims in Q3 2026 against 106), transport and healthcare more than doubled. Healthcare hit its highest level in the series: 356 claims, against 139 a year earlier.

Peaks have precise causes. The early 2025 peak comes mostly from Clop, which published the victims of the Cleo file transfer software flaw in one go: 335 claims in February 2025. The spring 2025 dip coincides with the end of that wave and with the disappearance of RansomHub, whose leak site went dark on 1 April 2025. A single group can therefore distort a whole year, either way.

This ranking differs from ENISA's, which puts public administration first in Europe. The reason: 82% of the public administration incidents it records are denial-of-service attacks by hacktivists. Ransomware hits private companies first.

More groups, fewer giants

How to read it: the chart switches point of view as the animation plays. "How many" stacks one dot per group active in the quarter. "How big" gives each dot a height proportional to its share of the quarter's claims. "Who stays" separates the groups already active in early 2025 from those that arrived since.

The number of active groups almost doubled. 68 groups claimed at least one victim in Q1 2025, 120 in Q3 2026. Most of the rise came in 2026: +16 in Q2, +30 in Q3.

The giants weigh less. The top five groups accounted for 47% of claims in early 2025, 35% in Q3 2026. Total volume doubled, but it is spread across many more players.

Turnover is fast. Of the 68 groups active in early 2025, only 30 were still posting in Q3 2026. Three in four groups active today (90 out of 120) were not active in early 2025. ANSSI sees the same thing in France, with more than ten new strains observed for the first time in 2025.

This spread comes from the business model. Most groups run ransomware as a service: a small team provides the malware, the leak site and the negotiation, and affiliates carry out the intrusions for a commission. Affiliates, scarce and mobile, drive the volume. When a brand falls, they join another one or start their own. Names change fast, people much less so.

For defenders, the consequence is concrete: knowledge about a group ages fast. A "groups to track" list drawn up in early 2025 now covers less than a third of the active players. It pays more to track intrusion methods (VPN access, flaws in exposed devices, stolen credentials) than brands.

Why a group disappears

Posting curves date the end of several groups, and each time an event explains it.

Arrests that hit a group's core stop it dead. 8Base still posted 25 victims in January 2025, 4 in February, then nothing: on 10 February 2025, Thai police arrested four Russian nationals in Phuket described as its leaders, and European law enforcement seized its leak site. In July 2025, Operation Checkmate seized BlackSuit's sites; its operators probably resurfaced as Chaos, whose activity climbs in 2026.

A single arrest is not enough. In May 2026, a 28-year-old Russian suspected of belonging to Qilin was arrested in an Osaka hotel and extradited to Germany. Qilin did not slow down: 114 claims in May, 165 in August. An affiliate can be replaced; infrastructure and a leadership team much less so.

Internal leaks kill trust. In February 2025, some 200,000 internal Black Basta messages were published: phishing templates, victim credentials, target research. The group, which still claimed 8 victims in January, posted nothing afterwards. In January 2026, Germany's federal criminal police (BKA) identified its alleged leader, Oleg Nefedov, since placed on Interpol's red notice list.

Some groups leave on their own. Hunters International announced its shutdown in July 2025, wiped its victims and offered free decryption tools; its operators carry on as World Leaks, which only steals and publishes data without encrypting it. RansomHub, with 88 claims in March 2025, went dark on 1 April without explanation. Its affiliates scattered, and Qilin benefited: its claims rose from 47 in March to 75 in April 2025.

War between groups

These groups are not just competitors, they attack each other.

In March 2025, DragonForce defaced the leak sites of BlackLock and Mamona, then claimed that RansomHub had joined its "cartel" just as RansomHub disappeared. In April 2025, Everest's site was defaced with a mocking message, "Don't do crime, CRIME IS BAD". The same message appeared in May 2025 on LockBit's admin panel, hacked along with its database: nearly 60,000 bitcoin addresses and more than 4,400 negotiation messages with victims were exposed. LockBit 3 stopped posting that month. The group came back with LockBit 5 in September 2025, and its first wave of posts reached 111 victims in December.

The rivalry continued in 2026. In April, the KryBit group hacked 0APT and showed that more than 190 of the victims it claimed in January were made up: a reminder that not every claim is real. In May, The Gentlemen's internal database leaked in turn. In September, ShinyHunters hacked Clop's leak site and tried to extort the group itself.

Alliances form too. In October 2025, researchers revealed that DragonForce, LockBit and Qilin had teamed up to share techniques and resources. In a market where affiliates are the scarce resource, joining forces and taking down a rival serve the same purpose: attracting the best.

Qilin settles in, The Gentlemen spills over

How to read it: each bubble is a group, sized by its number of claims over the period. The further right a group sits, the more victims it posts each month; the higher it sits, the more of its victims are outside the United States, the most targeted country with 45% of victims.

Qilin has settled at the top. The group went from 55 claims a month in H1 2025 to 110-120 since, picking up some of RansomHub's affiliates. ANSSI also ranks it first in France: 21% of the ransomware compromises it handled in 2025.

The Gentlemen is the real break. Active since at least July 2025 and probably founded by a former Qilin affiliate according to sources cited by Unit 42, it posted 165 victims a month in Q3 2026, more than any other group. Its offer explains its growth: it leaves 90% of ransoms to its affiliates. Above all, it strikes outside the United States first: only 19% of its victims are there, against 45% on average. A third are in Europe (a quarter on average), and Germany, France and the United Kingdom each count 42 victims, as many as Thailand or Brazil.

Others decline. Akira drops from 61 to 30 claims a month, Lynx almost disappears. Play stays focused on the United States, with fewer than one victim in four outside the country in most periods.

The centre of gravity is moving up the chart: the groups on the rise are the ones that look furthest beyond the United States, and to Europe first.

Office hours

How to read it: the clock shows a whole week, one full turn, Monday midnight at the top, clockwise. Each translucent veil is one month; where months overlap, the ink darkens. Red outlines mark the busiest hours.

At weekends there are about 45% fewer claims per day than on weekdays. Postings peak between 15:00 and 18:00 UTC, which is late afternoon in France and late morning on the US East Coast. The time measured is when the claim appears online, not when the intrusion happened: it describes the pace of extortion.

This office rhythm is no surprise to anyone who read the Conti leaks in 2022. The more than 60,000 internal messages published at the start of the war in Ukraine by someone presenting as a Ukrainian IT specialist described a company: staff paid $1,000 to $2,000 a month, on the 1st and the 15th, a five-day week, an HR department recruiting on Russian job sites, annual reviews, an "employee of the month" bonus and fines. The offensive team, for its part, rarely saw its weekends. The Gentlemen's internal database, published in 2026, shows the same division of labour: an administrator who builds the tools and assigns targets, initial access specialists, affiliates paid on commission.

And France?

France accounts for 402 claims over the period, 6th in the world behind the United States, Germany, Canada, the United Kingdom and Italy. Two groups account for a third of French victims: Qilin (97) and The Gentlemen (42).

How to read it: each stalk is a group, ranked from left to right by number of victims in France; each small dot stands for two victims. Other groups, less active in France, total 197 victims.

The weight of The Gentlemen, the 2nd group in France after just over a year of activity, confirms the underlying trend: new players are looking towards Europe. Security vendor ESET notes its affiliates' interest in France, Thailand and Brazil.

Leak sites also reveal victims that official statistics do not see: 189 claims targeted France in 2025, while ANSSI handled 128 ransomware compromises. An SME that reports nothing can end up on a leak site without ever entering the agency's figures.

Key takeaways

• Visible extortion doubled in a year, and the rise hits every sector, led by retail, transport and healthcare.
• The threat is spreading out: more groups, giants that weigh less, and brands that rise and fall with arrests, leaks and rivalries, while affiliates move from one to the next.
• Effective arrests hit the core: seizing infrastructure and arresting leaders stops a group, arresting one affiliate does not slow it down.
• Newcomers target Europe: The Gentlemen, now the most active group, strikes outside the United States first, and France is among its main targets.

These lists have blind spots. They say nothing about cost: Verizon's 2026 DBIR says 69% of ransomware victims did not pay. Nor do they say how attackers got in: ENISA itself identifies the intrusion method in only 5.2% of the unauthorised access incidents it records.

Sources

• LuksMentis, tracking of ransomware claims published on leak sites, January 2025 to September 2026: luksmentis.com
• ANSSI, Panorama de la cybermenace 2025, CERTFR-2026-CTI-002, March 2026 (128 ransomware compromises, Qilin 21% of strains, new strains): cert.ssi.gouv.fr
• ENISA, Threat Landscape 2026, 22 September 2026 (public administration, 81.8% of it denial of service; intrusion method known in 5.2% of access incidents): helpnetsecurity.com
• Europol, arrest of key figures behind Phobos and 8Base, February 2025: europol.europa.eu
• US Department of Justice, disruption of BlackSuit, 11 August 2025: justice.gov
• The Record, arrest in Japan of an alleged Qilin member, 9 October 2026: therecord.media
• BleepingComputer, Black Basta internal chat leak, February 2025: bleepingcomputer.com; alleged leader on Interpol's red notice list, January 2026: bleepingcomputer.com
• BleepingComputer, Hunters International shuts down, July 2025: bleepingcomputer.com
• Sophos, DragonForce targets rivals, 2025: sophos.com
• BleepingComputer, LockBit panel hacked, May 2025: bleepingcomputer.com
• Infosecurity Magazine, 0APT and KryBit, 28 April 2026: infosecurity-magazine.com
• BleepingComputer, ShinyHunters hacks Clop's leak site, 19 September 2026: bleepingcomputer.com
• The Hacker News, DragonForce, LockBit and Qilin alliance, October 2025: thehackernews.com
• Check Point Research, Thus Spoke The Gentlemen, 13 May 2026: research.checkpoint.com
• Palo Alto Networks Unit 42, The Gentlemen Ransomware, 10 July 2026 (link with Qilin): unit42.paloaltonetworks.com
• ESET, analysis of The Gentlemen's anti-EDR arsenal: eset.com
• Krebs on Security, Conti Ransomware Group Diaries, Part II: The Office, 2 March 2022: krebsonsecurity.com
• Check Point Research, Conti leaks, 10 March 2022: research.checkpoint.com
• Verizon, 2026 Data Breach Investigations Report (69% of ransomware victims did not pay): helpnetsecurity.com