Ransomware attacks in February 2026
781 victims · 56 active groups · 6 new groups · 710 in January 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 781 ransomware victims claimed on leak sites in February 2026, up 10.0% from 710 in January 2026.
- 56 groups posted at least one victim; the three most active groups, qilin (113), thegentlemen (84) and clop (79), accounted for 35.3% of the total.
- qilin was the most active group with 113 victims, up from 111 in January 2026.
- Manufacturing was the most-targeted sector with 116 victims (14.9% of the month's total), ahead of Technology (111).
- Organizations in the United States accounted for 359 victims (46.0%), followed by Germany (39) and Canada (35); 35 victims did not disclose a location.
- 6 groups appeared in HackerFeeds data for the first time this month, including payload, ShadowByt3$ and AuditTeam.
Daily activity
Busiest day: Feb 7 (72 victims). Quietest day: Feb 8 (10 victims). Victims were posted on 28 of 28 days.
Most active groups
| # | Group | Victims | Share | January 2026 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 113 | 14.5% | 111 | +2 |
| 2 | thegentlemen | 84 | 10.8% | 34 | +50 |
| 3 | clop | 79 | 10.1% | 46 | +33 |
| 4 | akira | 64 | 8.2% | 63 | +1 |
| 5 | play | 48 | 6.1% | 28 | +20 |
| 6 | nightspire | 42 | 5.4% | 29 | +13 |
| 7 | incransom | 41 | 5.2% | 49 | −8 |
| 8 | dragonforce | 36 | 4.6% | 12 | +24 |
| 9 | lockbit5 | 34 | 4.4% | 11 | +23 |
| 10 | vect | 20 | 2.6% | 2 | +18 |
| 11 | sinobi | 18 | 2.3% | 55 | −37 |
| 12 | everest | 13 | 1.7% | 21 | −8 |
| 13 | payoutsking | 12 | 1.5% | 15 | −3 |
| 14 | coinbasecartel | 11 | 1.4% | 7 | +4 |
| 15 | anubis | 11 | 1.4% | 5 | +6 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 116 | 14.9% |
| 2 | Technology | 111 | 14.2% |
| 3 | Business Services | 91 | 11.7% |
| 4 | Healthcare | 53 | 6.8% |
| 5 | Financial Services | 52 | 6.7% |
| 6 | Construction | 52 | 6.7% |
| 7 | Consumer Services | 48 | 6.1% |
| 8 | Transportation/Logistics | 38 | 4.9% |
| 9 | Agriculture and Food Production | 29 | 3.7% |
| 10 | Hospitality and Tourism | 27 | 3.5% |
| 11 | Energy | 25 | 3.2% |
| 12 | Public Sector | 24 | 3.1% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 359 | 46.0% |
| 2 | Germany | 39 | 5.0% |
| 3 | Canada | 35 | 4.5% |
| 4 | Italy | 21 | 2.7% |
| 5 | Brazil | 19 | 2.4% |
| 6 | United Kingdom | 18 | 2.3% |
| 7 | France | 18 | 2.3% |
| 8 | Australia | 18 | 2.3% |
| 9 | Japan | 15 | 1.9% |
| 10 | India | 15 | 1.9% |
| 11 | Spain | 15 | 1.9% |
| 12 | Thailand | 13 | 1.7% |
| 13 | Taiwan | 10 | 1.3% |
| 14 | Switzerland | 8 | 1.0% |
| 15 | Turkey | 7 | 0.9% |
35 victims (4.5%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| payload | Feb 17, 2026 |
| ShadowByt3$ | Feb 17, 2026 |
| AuditTeam | Feb 21, 2026 |
| kittykatkrew | Feb 23, 2026 |
| cipherforce | Feb 23, 2026 |
| PrinzEugen | Feb 27, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Pro-Plastics | qilin | US | Feb 28, 2026 |
| North Andover Country Club | qilin | US | Feb 28, 2026 |
| Schmuck Welt | qilin | DE | Feb 28, 2026 |
| Unibros Shipping | qilin | GR | Feb 28, 2026 |
| www.pyramisgroup.com | alphalocker | GR | Feb 28, 2026 |
| http://ramet-trom.co.il/ | incransom | IL | Feb 28, 2026 |
| SK-Telecom - Data reuploaded | coinbasecartel | KR | Feb 28, 2026 |
| UD Trucks | everest | JP | Feb 28, 2026 |
| Madesmart | akira | US | Feb 28, 2026 |
| Design To Print | play | US | Feb 28, 2026 |
| Keller Polska | lynx | PL | Feb 28, 2026 |
| Jiangsu Zenergy Battery Technologies Group Co., Ltd. | ransomhouse | CN | Feb 28, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 781 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.