Ransomware claims
Attacks ransomware gangs claim on their leak sites, counted by month, country, sector and gang. Totals only: no victim is named here.
Source: Ransomware.live
These are claims, not confirmed attacks. Gangs post victims to pressure them into paying, and sometimes exaggerate, repost old victims or invent them. Victims who pay quickly often never appear. Read the numbers as a measure of how active the gangs are.
- October 2026 so far
- 1,003claims
- September 2026
- 846claims
- Last 12 months
- 10,253claims
- In the GCC, same period
- 139claims naming a GCC country
Claims per month
Grouped by the month Ransomware.live files each claim under, usually when the gang posted it. The current month is still filling in.
Hover or tab through a month for its count. The lighter bar is the month in progress.
Show as a table
| Month | Claims | In the GCC |
|---|---|---|
| November 2025 | 717 | 14 |
| December 2025 | 881 | 16 |
| January 2026 | 700 | 6 |
| February 2026 | 785 | 13 |
| March 2026 | 843 | 10 |
| April 2026 | 865 | 10 |
| May 2026 | 787 | 10 |
| June 2026 | 711 | 9 |
| July 2026 | 952 | 13 |
| August 2026 | 1,163 | 15 |
| September 2026 | 846 | 8 |
| October 2026 | 1,003 | 15 |
Countries
Last 12 months. 718 claims named no country.
- United States4,006
- Germany499
- United Kingdom417
- Canada339
- Italy293
- France255
- Brazil245
- India214
- Spain207
- Australia167
Sectors
Last 12 months. 1,146 had no known sector.
- Manufacturing1,810
- Professional Services1,642
- Technology1,322
- Healthcare912
- Retail & E-Commerce749
- Financial Services536
- Transportation426
- Agriculture and Food Production393
- Government & Defense359
- Education354
Most active gangs
Last 12 months, by claims posted.
- qilin1,426
- thegentlemen958
- akira583
- incransom468
- dragonforce392
- lockbit5392
- nightspire283
- clop277
- play277
- safepay254
So far in October 2026: n0n (147), qilin (113), thegentlemen (93), nightspire (33), akira (32).
In the Gulf
Claims naming a GCC country, last 12 months.
- United Arab Emirates79
- Saudi Arabia31
- Oman11
- Qatar8
- Kuwait7
- Bahrain3
Source: Ransomware.live, which tracks ransomware gangs' leak sites. Used under its terms for non-commercial use; it gives no guarantee that a claimed attack happened as described. SentryFeed stores and shows only counts, updated once a day.