Ransomware attacks in October 2025
790 victims · 63 active groups · 7 new groups · 546 in September 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 790 ransomware victims claimed on leak sites in October 2025, up 44.7% from 546 in September 2025.
- 63 groups posted at least one victim; the three most active groups, qilin (192), akira (70) and sinobi (57), accounted for 40.4% of the total.
- qilin was the most active group with 192 victims, up from 78 in September 2025.
- Manufacturing was the most-targeted sector with 132 victims (16.7% of the month's total), ahead of Business Services (107).
- Organizations in the United States accounted for 386 victims (48.9%), followed by Canada (45) and Germany (28); 39 victims did not disclose a location.
- 7 groups appeared in HackerFeeds data for the first time this month, including nasirsecurity, vect and kryptos.
Daily activity
Busiest day: Oct 14 (61 victims). Quietest day: Oct 18 (7 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | September 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 192 | 24.3% | 78 | +114 |
| 2 | akira | 70 | 8.9% | 78 | −8 |
| 3 | sinobi | 57 | 7.2% | 9 | +48 |
| 4 | play | 34 | 4.3% | 39 | −5 |
| 5 | incransom | 33 | 4.2% | 37 | −4 |
| 6 | dragonforce | 20 | 2.5% | 9 | +11 |
| 7 | devman | 19 | 2.4% | 14 | +5 |
| 8 | ransomhouse | 18 | 2.3% | 2 | +16 |
| 9 | medusa | 17 | 2.2% | 9 | +8 |
| 10 | blackshrantac | 17 | 2.2% | 8 | +9 |
| 11 | safepay | 16 | 2.0% | 4 | +12 |
| 12 | nova | 16 | 2.0% | 4 | +12 |
| 13 | lynx | 14 | 1.8% | 25 | −11 |
| 14 | everest | 14 | 1.8% | 7 | +7 |
| 15 | coinbasecartel | 14 | 1.8% | 11 | +3 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 132 | 16.7% |
| 2 | Business Services | 107 | 13.5% |
| 3 | Technology | 91 | 11.5% |
| 4 | Healthcare | 71 | 9.0% |
| 5 | Consumer Services | 55 | 7.0% |
| 6 | Construction | 54 | 6.8% |
| 7 | Financial Services | 36 | 4.6% |
| 8 | Transportation/Logistics | 32 | 4.1% |
| 9 | Education | 31 | 3.9% |
| 10 | Agriculture and Food Production | 31 | 3.9% |
| 11 | Hospitality and Tourism | 28 | 3.5% |
| 12 | Public Sector | 26 | 3.3% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 386 | 48.9% |
| 2 | Canada | 45 | 5.7% |
| 3 | Germany | 28 | 3.5% |
| 4 | France | 27 | 3.4% |
| 5 | Spain | 23 | 2.9% |
| 6 | United Kingdom | 20 | 2.5% |
| 7 | Japan | 15 | 1.9% |
| 8 | Australia | 15 | 1.9% |
| 9 | Brazil | 10 | 1.3% |
| 10 | United Arab Emirates | 10 | 1.3% |
| 11 | India | 9 | 1.1% |
| 12 | Sweden | 8 | 1.0% |
| 13 | Malaysia | 8 | 1.0% |
| 14 | Switzerland | 8 | 1.0% |
| 15 | Netherlands | 7 | 0.9% |
39 victims (4.9%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| nasirsecurity | Oct 5, 2025 |
| vect | Oct 5, 2025 |
| kryptos | Oct 8, 2025 |
| radiant | Oct 12, 2025 |
| tridentlocker | Oct 21, 2025 |
| tengu | Oct 23, 2025 |
| orion | Oct 28, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| aa-llp.com (aa.law) | incransom | US | Oct 31, 2025 |
| ANSELL.COM | clop | BE | Oct 31, 2025 |
| MASTEC.COM | clop | US | Oct 31, 2025 |
| Fouad Alghanim & Sons Group of Companies Holding W.L.L. | radar | KW | Oct 31, 2025 |
| TMF Logistics | incransom | DZ | Oct 31, 2025 |
| Gun Accessory Supply | qilin | US | Oct 31, 2025 |
| CCI Tax Pros, Inc | blackshrantac | US | Oct 31, 2025 |
| VZW Avalon | incransom | BE | Oct 31, 2025 |
| The Matlusky Firm LLC | blackshrantac | US | Oct 31, 2025 |
| CyPark Resources Berhad | blackshrantac | MY | Oct 31, 2025 |
| TENAX Law Group PC | blackshrantac | US | Oct 31, 2025 |
| www.verdugohillsdental.com | alphalocker | US | Oct 31, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 790 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.