Ransomware attacks in August 2025
522 victims · 56 active groups · 1 new groups · 503 in July 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 522 ransomware victims claimed on leak sites in August 2025, up 3.8% from 503 in July 2025.
- 56 groups posted at least one victim; the three most active groups, qilin (85), akira (55) and play (36), accounted for 33.7% of the total.
- qilin was the most active group with 85 victims, up from 55 in July 2025.
- Manufacturing was the most-targeted sector with 86 victims (16.5% of the month's total), ahead of Business Services (75).
- Organizations in the United States accounted for 280 victims (53.6%), followed by the United Kingdom (32) and Germany (27); 16 victims did not disclose a location.
- One group, desolator, appeared in HackerFeeds data for the first time this month.
Daily activity
Busiest day: Aug 29 (35 victims). Quietest day: Aug 24 (3 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | July 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 85 | 16.3% | 55 | +30 |
| 2 | akira | 55 | 10.5% | 45 | +10 |
| 3 | play | 36 | 6.9% | 23 | +13 |
| 4 | incransom | 29 | 5.6% | 44 | −15 |
| 5 | sinobi | 27 | 5.2% | 11 | +16 |
| 6 | safepay | 27 | 5.2% | 14 | +13 |
| 7 | dragonforce | 27 | 5.2% | 23 | +4 |
| 8 | warlock | 20 | 3.8% | 9 | +11 |
| 9 | cephalus | 18 | 3.4% | 0 | +18 |
| 10 | worldleaks | 16 | 3.1% | 17 | −1 |
| 11 | everest | 15 | 2.9% | 19 | −4 |
| 12 | interlock | 11 | 2.1% | 4 | +7 |
| 13 | direwolf | 11 | 2.1% | 12 | −1 |
| 14 | d4rk4rmy | 11 | 2.1% | 7 | +4 |
| 15 | lynx | 9 | 1.7% | 18 | −9 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 86 | 16.5% |
| 2 | Business Services | 75 | 14.4% |
| 3 | Technology | 61 | 11.7% |
| 4 | Healthcare | 55 | 10.5% |
| 5 | Construction | 50 | 9.6% |
| 6 | Financial Services | 38 | 7.3% |
| 7 | Consumer Services | 23 | 4.4% |
| 8 | Education | 22 | 4.2% |
| 9 | Public Sector | 19 | 3.6% |
| 10 | Transportation/Logistics | 17 | 3.3% |
| 11 | Hospitality and Tourism | 15 | 2.9% |
| 12 | Agriculture and Food Production | 12 | 2.3% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 280 | 53.6% |
| 2 | United Kingdom | 32 | 6.1% |
| 3 | Germany | 27 | 5.2% |
| 4 | Canada | 16 | 3.1% |
| 5 | Japan | 11 | 2.1% |
| 6 | Italy | 11 | 2.1% |
| 7 | Australia | 11 | 2.1% |
| 8 | Brazil | 8 | 1.5% |
| 9 | Taiwan | 7 | 1.3% |
| 10 | France | 7 | 1.3% |
| 11 | Mexico | 6 | 1.1% |
| 12 | Spain | 6 | 1.1% |
| 13 | Colombia | 5 | 1.0% |
| 14 | Poland | 4 | 0.8% |
| 15 | Netherlands | 4 | 0.8% |
16 victims (3.1%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| desolator | Aug 27, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| cardiofocus.com | incransom | US | Aug 31, 2025 |
| Cordeiro Guerra & Associati | everest | IT | Aug 31, 2025 |
| FedEx | shinyhunters | US | Aug 31, 2025 |
| Healthy Living Market and Café | genesis | US | Aug 31, 2025 |
| LEVEL | desolator | US | Aug 31, 2025 |
| Engineered Components | dragonforce | US | Aug 30, 2025 |
| Provalve Armaturen GmbH & Co. KG | dragonforce | DE | Aug 30, 2025 |
| Toowoomba Friendly Society Dispensary | dragonforce | AU | Aug 30, 2025 |
| Park Country Club | dragonforce | US | Aug 30, 2025 |
| Hilco Metal Building & Roofing Supply | dragonforce | US | Aug 30, 2025 |
| ABM Wireless INC | dragonforce | US | Aug 30, 2025 |
| Mold In Graphic Systems | akira | US | Aug 30, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 522 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.