Ransomware attacks in July 2025
503 victims · 58 active groups · 5 new groups · 546 in June 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 503 ransomware victims claimed on leak sites in July 2025, down 7.9% from 546 in June 2025.
- 58 groups posted at least one victim; the three most active groups, qilin (55), akira (45) and incransom (44), accounted for 28.6% of the total.
- qilin was the most active group with 55 victims, down from 89 in June 2025.
- Business Services was the most-targeted sector with 85 victims (16.9% of the month's total), ahead of Manufacturing (71).
- Organizations in the United States accounted for 243 victims (48.3%), followed by Italy (17) and the United Kingdom (16); 31 victims did not disclose a location.
- 5 groups appeared in HackerFeeds data for the first time this month, including satanlockv2, d4rk4rmy and rebornvc.
Daily activity
Busiest day: Jul 15 (36 victims). Quietest day: Jul 19 (2 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | June 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 55 | 10.9% | 89 | −34 |
| 2 | akira | 45 | 8.9% | 33 | +12 |
| 3 | incransom | 44 | 8.7% | 47 | −3 |
| 4 | play | 23 | 4.6% | 28 | −5 |
| 5 | dragonforce | 23 | 4.6% | 24 | −1 |
| 6 | everest | 19 | 3.8% | 9 | +10 |
| 7 | lynx | 18 | 3.6% | 24 | −6 |
| 8 | worldleaks | 17 | 3.4% | 19 | −2 |
| 9 | safepay | 14 | 2.8% | 36 | −22 |
| 10 | global | 14 | 2.8% | 15 | −1 |
| 11 | devman | 13 | 2.6% | 1 | +12 |
| 12 | pear | 12 | 2.4% | 6 | +6 |
| 13 | direwolf | 12 | 2.4% | 6 | +6 |
| 14 | sinobi | 11 | 2.2% | 7 | +4 |
| 15 | handala | 11 | 2.2% | 23 | −12 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 85 | 16.9% |
| 2 | Manufacturing | 71 | 14.1% |
| 3 | Technology | 63 | 12.5% |
| 4 | Construction | 36 | 7.2% |
| 5 | Healthcare | 32 | 6.4% |
| 6 | Consumer Services | 31 | 6.2% |
| 7 | Financial Services | 27 | 5.4% |
| 8 | Education | 20 | 4.0% |
| 9 | Agriculture and Food Production | 19 | 3.8% |
| 10 | Public Sector | 17 | 3.4% |
| 11 | Transportation/Logistics | 15 | 3.0% |
| 12 | Telecommunication | 14 | 2.8% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 243 | 48.3% |
| 2 | Italy | 17 | 3.4% |
| 3 | United Kingdom | 16 | 3.2% |
| 4 | France | 16 | 3.2% |
| 5 | Canada | 15 | 3.0% |
| 6 | Germany | 14 | 2.8% |
| 7 | Brazil | 12 | 2.4% |
| 8 | Japan | 9 | 1.8% |
| 9 | Spain | 8 | 1.6% |
| 10 | Thailand | 7 | 1.4% |
| 11 | Sweden | 7 | 1.4% |
| 12 | Turkey | 6 | 1.2% |
| 13 | Australia | 6 | 1.2% |
| 14 | Mexico | 5 | 1.0% |
| 15 | United Kingdom | 4 | 0.8% |
31 victims (6.2%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| satanlockv2 | Jul 4, 2025 |
| d4rk4rmy | Jul 7, 2025 |
| rebornvc | Jul 8, 2025 |
| obscura | Jul 16, 2025 |
| bqtlock | Jul 31, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Framon S.p.A. | dragonforce | IT | Jul 31, 2025 |
| Quartus Engineering | play | US | Jul 31, 2025 |
| eFunda, Inc. | bqtlock | US | Jul 31, 2025 |
| USA Military Alumni Networks | bqtlock | US | Jul 31, 2025 |
| Devon | incransom | CA | Jul 31, 2025 |
| RAVEN Mechanical | akira | US | Jul 31, 2025 |
| Cevital | akira | DZ | Jul 31, 2025 |
| Guyana Sugar | akira | GY | Jul 31, 2025 |
| csrepair.com | qilin | US | Jul 31, 2025 |
| Radford City Schools | incransom | US | Jul 31, 2025 |
| Horizon Hydraulics | sinobi | US | Jul 31, 2025 |
| Ieee-apscon.org | flocker | US | Jul 31, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 503 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.