Ransomware attacks in January 2026
710 victims · 56 active groups · 2 new groups · 810 in December 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 710 ransomware victims claimed on leak sites in January 2026, down 12.3% from 810 in December 2025.
- 56 groups posted at least one victim; the three most active groups, qilin (111), akira (63) and sinobi (55), accounted for 32.3% of the total.
- qilin was the most active group with 111 victims, down from 176 in December 2025.
- Manufacturing was the most-targeted sector with 111 victims (15.6% of the month's total), ahead of Technology (94).
- Organizations in the United States accounted for 333 victims (46.9%), followed by the United Kingdom (29) and Canada (25); 26 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: sicarii and cmdorganization.
Daily activity
Busiest day: Jan 25 (65 victims). Quietest day: Jan 1 (1 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | December 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 111 | 15.6% | 176 | −65 |
| 2 | akira | 63 | 8.9% | 58 | +5 |
| 3 | sinobi | 55 | 7.7% | 54 | +1 |
| 4 | incransom | 49 | 6.9% | 38 | +11 |
| 5 | clop | 46 | 6.5% | 1 | +45 |
| 6 | thegentlemen | 34 | 4.8% | 10 | +24 |
| 7 | devman | 30 | 4.2% | 46 | −16 |
| 8 | nightspire | 29 | 4.1% | 7 | +22 |
| 9 | tengu | 28 | 3.9% | 1 | +27 |
| 10 | play | 28 | 3.9% | 20 | +8 |
| 11 | lynx | 26 | 3.7% | 14 | +12 |
| 12 | everest | 21 | 3.0% | 10 | +11 |
| 13 | payoutsking | 15 | 2.1% | 0 | +15 |
| 14 | safepay | 12 | 1.7% | 59 | −47 |
| 15 | dragonforce | 12 | 1.7% | 35 | −23 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 111 | 15.6% |
| 2 | Technology | 94 | 13.2% |
| 3 | Business Services | 80 | 11.3% |
| 4 | Healthcare | 49 | 6.9% |
| 5 | Construction | 48 | 6.8% |
| 6 | Consumer Services | 47 | 6.6% |
| 7 | Financial Services | 40 | 5.6% |
| 8 | Public Sector | 28 | 3.9% |
| 9 | Transportation/Logistics | 26 | 3.7% |
| 10 | Energy | 23 | 3.2% |
| 11 | Agriculture and Food Production | 23 | 3.2% |
| 12 | Education | 22 | 3.1% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 333 | 46.9% |
| 2 | United Kingdom | 29 | 4.1% |
| 3 | Canada | 25 | 3.5% |
| 4 | Italy | 22 | 3.1% |
| 5 | Spain | 21 | 3.0% |
| 6 | Germany | 21 | 3.0% |
| 7 | India | 19 | 2.7% |
| 8 | France | 19 | 2.7% |
| 9 | Taiwan | 13 | 1.8% |
| 10 | Brazil | 12 | 1.7% |
| 11 | United Kingdom | 10 | 1.4% |
| 12 | Malaysia | 9 | 1.3% |
| 13 | Mexico | 9 | 1.3% |
| 14 | Australia | 8 | 1.1% |
| 15 | Svalbard & Jan Mayen | 7 | 1.0% |
26 victims (3.7%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| sicarii | Jan 5, 2026 |
| cmdorganization | Jan 25, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Hawk Law Group | incransom | GE | Jan 31, 2026 |
| Nobel Hygiene Pvt | thegentlemen | IN | Jan 31, 2026 |
| Handsome Manufacturing | thegentlemen | HK | Jan 31, 2026 |
| Transaction Packing | play | US | Jan 31, 2026 |
| Transaction Packing Inc | ransomhouse | US | Jan 31, 2026 |
| Neuviz | coinbasecartel | ID | Jan 31, 2026 |
| CigamSoftware | coinbasecartel | BR | Jan 31, 2026 |
| Pellenc | coinbasecartel | FR | Jan 31, 2026 |
| pellenc.com | ALP-001 | FR | Jan 31, 2026 |
| Dolby Laboratories | coinbasecartel | US | Jan 31, 2026 |
| all Data | tengu | — | Jan 31, 2026 |
| Wieson Technologies | thegentlemen | TW | Jan 31, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 710 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.