Ransomware attacks in June 2025
546 victims · 55 active groups · 4 new groups · 512 in May 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 546 ransomware victims claimed on leak sites in June 2025, up 6.6% from 512 in May 2025.
- 55 groups posted at least one victim; the three most active groups, qilin (89), incransom (47) and safepay (36), accounted for 31.5% of the total.
- qilin was the most active group with 89 victims, up from 68 in May 2025.
- Manufacturing was the most-targeted sector with 83 victims (15.2% of the month's total), ahead of Business Services (66).
- Organizations in the United States accounted for 260 victims (47.6%), followed by Canada (32) and the United Kingdom (28); 13 victims did not disclose a location.
- 4 groups appeared in HackerFeeds data for the first time this month, including walocker, securotrop and kawa4096.
Daily activity
Busiest day: Jun 11 (31 victims). Quietest day: Jun 21 (2 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | May 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 89 | 16.3% | 68 | +21 |
| 2 | incransom | 47 | 8.6% | 18 | +29 |
| 3 | safepay | 36 | 6.6% | 54 | −18 |
| 4 | akira | 33 | 6.0% | 48 | −15 |
| 5 | play | 28 | 5.1% | 39 | −11 |
| 6 | lynx | 24 | 4.4% | 14 | +10 |
| 7 | dragonforce | 24 | 4.4% | 0 | +24 |
| 8 | handala | 23 | 4.2% | 0 | +23 |
| 9 | worldleaks | 19 | 3.5% | 21 | −2 |
| 10 | sarcoma | 16 | 2.9% | 4 | +12 |
| 11 | global | 15 | 2.7% | 1 | +14 |
| 12 | kawa4096 | 12 | 2.2% | 0 | +12 |
| 13 | warlock | 11 | 2.0% | 2 | +9 |
| 14 | shinyhunters | 11 | 2.0% | 7 | +4 |
| 15 | nightspire | 10 | 1.8% | 17 | −7 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 83 | 15.2% |
| 2 | Business Services | 66 | 12.1% |
| 3 | Technology | 59 | 10.8% |
| 4 | Healthcare | 50 | 9.2% |
| 5 | Construction | 44 | 8.1% |
| 6 | Consumer Services | 37 | 6.8% |
| 7 | Financial Services | 31 | 5.7% |
| 8 | Education | 27 | 4.9% |
| 9 | Public Sector | 25 | 4.6% |
| 10 | Agriculture and Food Production | 25 | 4.6% |
| 11 | Transportation/Logistics | 22 | 4.0% |
| 12 | Hospitality and Tourism | 17 | 3.1% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| walocker | Jun 10, 2025 |
| securotrop | Jun 11, 2025 |
| kawa4096 | Jun 19, 2025 |
| cephalus | Jun 28, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Portel Logistic Technologies | nova | ES | Jun 30, 2025 |
| JN Aceros | thegentlemen | CO | Jun 30, 2025 |
| oandg.com.au | kairos | AU | Jun 30, 2025 |
| Hotam EC | handala | EC | Jun 30, 2025 |
| Pinnacle Woodwork | akira | CA | Jun 30, 2025 |
| Watermark Marine Systems | akira | US | Jun 30, 2025 |
| Murex Petroleum | akira | US | Jun 30, 2025 |
| HRConnects, LLC | akira | US | Jun 30, 2025 |
| simmons-Boardman Publishing, Inc | qilin | US | Jun 30, 2025 |
| semco-tech.com | qilin | FR | Jun 30, 2025 |
| www.nuphoton.com | qilin | US | Jun 30, 2025 |
| FormWood Industries | play | US | Jun 30, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 546 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.