All monthly reports
Ransomware attacks in November 2025
694 victims · 61 active groups · 3 new groups · 790 in October 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 694 ransomware victims claimed on leak sites in November 2025, down 12.2% from 790 in October 2025.
- 61 groups posted at least one victim; the three most active groups, qilin (105), clop (98) and akira (69), accounted for 39.2% of the total.
- qilin was the most active group with 105 victims, down from 192 in October 2025.
- Manufacturing was the most-targeted sector with 111 victims (16.0% of the month's total), ahead of Technology (79).
- Organizations in the United States accounted for 338 victims (48.7%), followed by Canada (30) and Germany (24); 32 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: kazu, reynolds and benzona.
Daily activity
Busiest day: Nov 21 (82 victims). Quietest day: Nov 16 (3 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | October 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 105 | 15.1% | 192 | −87 |
| 2 | clop | 98 | 14.1% | 13 | +85 |
| 3 | akira | 69 | 9.9% | 70 | −1 |
| 4 | incransom | 42 | 6.1% | 33 | +9 |
| 5 | play | 26 | 3.7% | 34 | −8 |
| 6 | dragonforce | 24 | 3.5% | 20 | +4 |
| 7 | payoutsking | 23 | 3.3% | 3 | +20 |
| 8 | sinobi | 22 | 3.2% | 57 | −35 |
| 9 | safepay | 22 | 3.2% | 16 | +6 |
| 10 | warlock | 17 | 2.4% | 0 | +17 |
| 11 | thegentlemen | 15 | 2.2% | 7 | +8 |
| 12 | nightspire | 15 | 2.2% | 6 | +9 |
| 13 | everest | 13 | 1.9% | 14 | −1 |
| 14 | devman | 13 | 1.9% | 19 | −6 |
| 15 | coinbasecartel | 12 | 1.7% | 14 | −2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 111 | 16.0% |
| 2 | Technology | 79 | 11.4% |
| 3 | Business Services | 70 | 10.1% |
| 4 | Healthcare | 62 | 8.9% |
| 5 | Construction | 47 | 6.8% |
| 6 | Consumer Services | 40 | 5.8% |
| 7 | Financial Services | 31 | 4.5% |
| 8 | Energy | 29 | 4.2% |
| 9 | Education | 27 | 3.9% |
| 10 | Transportation/Logistics | 24 | 3.5% |
| 11 | Public Sector | 24 | 3.5% |
| 12 | Agriculture and Food Production | 17 | 2.4% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 338 | 48.7% |
| 2 | Canada | 30 | 4.3% |
| 3 | Germany | 24 | 3.5% |
| 4 | United Kingdom | 22 | 3.2% |
| 5 | India | 16 | 2.3% |
| 6 | Japan | 13 | 1.9% |
| 7 | Spain | 13 | 1.9% |
| 8 | Brazil | 13 | 1.9% |
| 9 | Mexico | 12 | 1.7% |
| 10 | Australia | 11 | 1.6% |
| 11 | Austria | 11 | 1.6% |
| 12 | Italy | 9 | 1.3% |
| 13 | France | 9 | 1.3% |
| 14 | Thailand | 8 | 1.2% |
| 15 | Switzerland | 8 | 1.2% |
32 victims (4.6%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Veton Ai | qilin | US | Nov 30, 2025 |
| Battaglioli | qilin | IT | Nov 30, 2025 |
| Division 10 | dragonforce | US | Nov 30, 2025 |
| ILCA Targhe s.r.l. | qilin | IT | Nov 30, 2025 |
| Asia Condominium Association | qilin | US | Nov 29, 2025 |
| Bomchil | qilin | AR | Nov 29, 2025 |
| TBC Consoles | qilin | US | Nov 29, 2025 |
| CJW | qilin | US | Nov 29, 2025 |
| Chenango Valley Technologies | qilin | US | Nov 29, 2025 |
| Rasen Insaat Ve Yatirim Ticaret A.S. | blackshrantac | TR | Nov 29, 2025 |
| Badan Pengelola Keuangan Haji | blackshrantac | ID | Nov 29, 2025 |
| 8200 Unit corpses | handala | — | Nov 29, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 694 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.