All monthly reports
Ransomware attacks in December 2025
810 victims · 58 active groups · 3 new groups · 694 in November 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 810 ransomware victims claimed on leak sites in December 2025, up 16.7% from 694 in November 2025.
- 58 groups posted at least one victim; the three most active groups, qilin (176), lockbit5 (69) and safepay (59), accounted for 37.5% of the total.
- qilin was the most active group with 176 victims, up from 105 in November 2025.
- Manufacturing was the most-targeted sector with 123 victims (15.2% of the month's total), ahead of Business Services (102).
- Organizations in the United States accounted for 342 victims (42.2%), followed by Germany (40) and Canada (35); 31 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: minteye, osiris and ms13089.
Daily activity
Busiest day: Dec 24 (55 victims). Quietest day: Dec 21 (7 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | November 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 176 | 21.7% | 105 | +71 |
| 2 | lockbit5 | 69 | 8.5% | 4 | +65 |
| 3 | safepay | 59 | 7.3% | 22 | +37 |
| 4 | akira | 58 | 7.2% | 69 | −11 |
| 5 | sinobi | 54 | 6.7% | 22 | +32 |
| 6 | devman | 46 | 5.7% | 13 | +33 |
| 7 | incransom | 38 | 4.7% | 42 | −4 |
| 8 | dragonforce | 35 | 4.3% | 24 | +11 |
| 9 | coinbasecartel | 22 | 2.7% | 12 | +10 |
| 10 | play | 20 | 2.5% | 26 | −6 |
| 11 | nova | 14 | 1.7% | 11 | +3 |
| 12 | lynx | 14 | 1.7% | 3 | +11 |
| 13 | ransomhouse | 12 | 1.5% | 7 | +5 |
| 14 | handala | 12 | 1.5% | 6 | +6 |
| 15 | worldleaks | 11 | 1.4% | 6 | +5 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 123 | 15.2% |
| 2 | Business Services | 102 | 12.6% |
| 3 | Technology | 93 | 11.5% |
| 4 | Healthcare | 65 | 8.0% |
| 5 | Construction | 62 | 7.7% |
| 6 | Consumer Services | 46 | 5.7% |
| 7 | Financial Services | 43 | 5.3% |
| 8 | Agriculture and Food Production | 36 | 4.4% |
| 9 | Public Sector | 33 | 4.1% |
| 10 | Transportation/Logistics | 27 | 3.3% |
| 11 | Education | 27 | 3.3% |
| 12 | Hospitality and Tourism | 22 | 2.7% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 342 | 42.2% |
| 2 | Germany | 40 | 4.9% |
| 3 | Canada | 35 | 4.3% |
| 4 | France | 28 | 3.5% |
| 5 | United Kingdom | 22 | 2.7% |
| 6 | Italy | 21 | 2.6% |
| 7 | Spain | 20 | 2.5% |
| 8 | Brazil | 19 | 2.3% |
| 9 | India | 17 | 2.1% |
| 10 | Turkey | 12 | 1.5% |
| 11 | Australia | 11 | 1.4% |
| 12 | Argentina | 11 | 1.4% |
| 13 | United Arab Emirates | 10 | 1.2% |
| 14 | Malaysia | 9 | 1.1% |
| 15 | Japan | 8 | 1.0% |
31 victims (3.8%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| KOPA Kozmetik A | qilin | TR | Dec 31, 2025 |
| Luminex Software | qilin | US | Dec 31, 2025 |
| BNZ Materials | qilin | US | Dec 31, 2025 |
| Options | lynx | CA | Dec 31, 2025 |
| Hunneman | interlock | US | Dec 31, 2025 |
| Z-Tronix | qilin | US | Dec 31, 2025 |
| Quasar | qilin | US | Dec 31, 2025 |
| TaLachaim | qilin | IL | Dec 31, 2025 |
| Burnham Brown | incransom | US | Dec 31, 2025 |
| 3GH Informatica Integral | incransom | ES | Dec 31, 2025 |
| Stewart Engenharia | thegentlemen | BR | Dec 30, 2025 |
| Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics | rhysida | US | Dec 30, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 810 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.