Ransomware attacks in September 2025
546 victims · 60 active groups · 4 new groups · 522 in August 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 546 ransomware victims claimed on leak sites in September 2025, up 4.6% from 522 in August 2025.
- 60 groups posted at least one victim; the three most active groups, qilin (78), akira (78) and play (39), accounted for 35.7% of the total.
- qilin was the most active group with 78 victims, down from 85 in August 2025.
- Manufacturing was the most-targeted sector with 80 victims (14.7% of the month's total), ahead of Technology (66).
- Organizations in the United States accounted for 279 victims (51.1%), followed by Germany (24) and Canada (24); 21 victims did not disclose a location.
- 4 groups appeared in HackerFeeds data for the first time this month, including lunalock, yurei and Ethics.
Daily activity
Busiest day: Sep 4 (32 victims). Quietest day: Sep 21 (4 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | August 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 78 | 14.3% | 85 | −7 |
| 2 | akira | 78 | 14.3% | 55 | +23 |
| 3 | play | 39 | 7.1% | 36 | +3 |
| 4 | incransom | 37 | 6.8% | 29 | +8 |
| 5 | killsec | 32 | 5.9% | 2 | +30 |
| 6 | lynx | 25 | 4.6% | 9 | +16 |
| 7 | thegentlemen | 18 | 3.3% | 6 | +12 |
| 8 | devman | 14 | 2.6% | 6 | +8 |
| 9 | warlock | 11 | 2.0% | 20 | −9 |
| 10 | coinbasecartel | 11 | 2.0% | 2 | +9 |
| 11 | pear | 10 | 1.8% | 8 | +2 |
| 12 | sinobi | 9 | 1.6% | 27 | −18 |
| 13 | radar | 9 | 1.6% | 3 | +6 |
| 14 | medusa | 9 | 1.6% | 4 | +5 |
| 15 | dragonforce | 9 | 1.6% | 27 | −18 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 80 | 14.7% |
| 2 | Technology | 66 | 12.1% |
| 3 | Financial Services | 66 | 12.1% |
| 4 | Construction | 50 | 9.2% |
| 5 | Business Services | 47 | 8.6% |
| 6 | Healthcare | 36 | 6.6% |
| 7 | Consumer Services | 34 | 6.2% |
| 8 | Education | 21 | 3.8% |
| 9 | Agriculture and Food Production | 20 | 3.7% |
| 10 | Transportation/Logistics | 15 | 2.7% |
| 11 | Hospitality and Tourism | 15 | 2.7% |
| 12 | Energy | 14 | 2.6% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 279 | 51.1% |
| 2 | Germany | 24 | 4.4% |
| 3 | Canada | 24 | 4.4% |
| 4 | South Korea | 18 | 3.3% |
| 5 | Italy | 13 | 2.4% |
| 6 | United Kingdom | 12 | 2.2% |
| 7 | France | 12 | 2.2% |
| 8 | India | 10 | 1.8% |
| 9 | Spain | 7 | 1.3% |
| 10 | China | 6 | 1.1% |
| 11 | Australia | 6 | 1.1% |
| 12 | Taiwan | 5 | 0.9% |
| 13 | Thailand | 5 | 0.9% |
| 14 | Japan | 5 | 0.9% |
| 15 | Hong Kong | 5 | 0.9% |
21 victims (3.8%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| lunalock | Sep 2, 2025 |
| yurei | Sep 5, 2025 |
| Ethics | Sep 11, 2025 |
| blackshrantac | Sep 17, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| C Well | coinbasecartel | — | Sep 30, 2025 |
| Weschler's Auctioneers | securotrop | US | Sep 30, 2025 |
| The L B | coinbasecartel | — | Sep 30, 2025 |
| Storage King | anubis | AU | Sep 30, 2025 |
| Edmunds.com, Inc. | shinyhunters | US | Sep 30, 2025 |
| Linxx Global Solutions | payoutsking | US | Sep 30, 2025 |
| L****s | payoutsking | US | Sep 30, 2025 |
| wrapex | devman | CA | Sep 30, 2025 |
| JW Howard Attorneys | securotrop | US | Sep 30, 2025 |
| Gershow Recycling | akira | US | Sep 30, 2025 |
| Palacios Marine & Industrial | akira | US | Sep 30, 2025 |
| Nvno | akira | US | Sep 30, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 546 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.