Ransomware attacks in March 2026
799 victims · 55 active groups · 6 new groups · 781 in February 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 799 ransomware victims claimed on leak sites in March 2026, up 2.3% from 781 in February 2026.
- 55 groups posted at least one victim; the three most active groups, qilin (136), nightspire (66) and thegentlemen (58), accounted for 32.5% of the total.
- qilin was the most active group with 136 victims, up from 113 in February 2026.
- Manufacturing was the most-targeted sector with 107 victims (13.4% of the month's total), ahead of Technology (96).
- Organizations in the United States accounted for 348 victims (43.6%), followed by France (36) and the United Kingdom (31); 58 victims did not disclose a location.
- 6 groups appeared in HackerFeeds data for the first time this month, including Doommageddon, exitium and kyber.
Daily activity
Busiest day: Mar 6 (41 victims). Quietest day: Mar 8 (8 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | February 2026 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 136 | 17.0% | 113 | +23 |
| 2 | nightspire | 66 | 8.3% | 42 | +24 |
| 3 | thegentlemen | 58 | 7.3% | 84 | −26 |
| 4 | dragonforce | 56 | 7.0% | 36 | +20 |
| 5 | incransom | 50 | 6.3% | 41 | +9 |
| 6 | lockbit5 | 49 | 6.1% | 34 | +15 |
| 7 | akira | 46 | 5.8% | 64 | −18 |
| 8 | handala | 39 | 4.9% | 2 | +37 |
| 9 | coinbasecartel | 33 | 4.1% | 11 | +22 |
| 10 | play | 26 | 3.3% | 48 | −22 |
| 11 | payload | 21 | 2.6% | 2 | +19 |
| 12 | genesis | 17 | 2.1% | 10 | +7 |
| 13 | shinyhunters | 16 | 2.0% | 9 | +7 |
| 14 | lapsus$ | 14 | 1.8% | 0 | +14 |
| 15 | worldleaks | 13 | 1.6% | 7 | +6 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 107 | 13.4% |
| 2 | Technology | 96 | 12.0% |
| 3 | Business Services | 95 | 11.9% |
| 4 | Healthcare | 68 | 8.5% |
| 5 | Construction | 52 | 6.5% |
| 6 | Financial Services | 51 | 6.4% |
| 7 | Consumer Services | 41 | 5.1% |
| 8 | Public Sector | 33 | 4.1% |
| 9 | Education | 32 | 4.0% |
| 10 | Transportation/Logistics | 28 | 3.5% |
| 11 | Agriculture and Food Production | 26 | 3.3% |
| 12 | Energy | 23 | 2.9% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| Doommageddon | Mar 8, 2026 |
| exitium | Mar 17, 2026 |
| kyber | Mar 18, 2026 |
| blackwater | Mar 20, 2026 |
| cry0 | Mar 30, 2026 |
| krybit | Mar 30, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Service Star Freightways | qilin | CA | Mar 31, 2026 |
| Seeing Machines | qilin | AU | Mar 31, 2026 |
| SERAM SpA | qilin | IT | Mar 31, 2026 |
| IranWire | handala | IR | Mar 31, 2026 |
| delapazlaw.com | incransom | US | Mar 31, 2026 |
| Chickasaw Holding | qilin | US | Mar 31, 2026 |
| https://www.lagoonpark.com/ | embargo | US | Mar 31, 2026 |
| Q-Lab | qilin | US | Mar 31, 2026 |
| San Felipe Del Rio CISD School | worldleaks | US | Mar 31, 2026 |
| Parque Eólico Toabré | everest | PA | Mar 31, 2026 |
| Hallmark Cards, Inc. & Hallmark Plus | shinyhunters | US | Mar 31, 2026 |
| submissionfinance.com | incransom | AU | Mar 31, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 799 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.