Ransomware attacks in April 2026
794 victims · 62 active groups · 9 new groups · 799 in March 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 794 ransomware victims claimed on leak sites in April 2026, down 0.6% from 799 in March 2026.
- 62 groups posted at least one victim; the three most active groups, qilin (107), thegentlemen (87) and dragonforce (63), accounted for 32.4% of the total.
- qilin was the most active group with 107 victims, down from 136 in March 2026.
- Business Services was the most-targeted sector with 162 victims (20.4% of the month's total), ahead of Manufacturing (111).
- Organizations in the United States accounted for 281 victims (35.4%), followed by Germany (48) and the United Kingdom (43); 32 victims did not disclose a location.
- 9 groups appeared in HackerFeeds data for the first time this month, including shadowbyt3$, netrunner and TiMc.
Daily activity
Busiest day: Apr 27 (98 victims). Quietest day: Apr 12 (5 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | March 2026 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 107 | 13.5% | 136 | −29 |
| 2 | thegentlemen | 87 | 11.0% | 58 | +29 |
| 3 | dragonforce | 63 | 7.9% | 56 | +7 |
| 4 | apt73 | 58 | 7.3% | 0 | +58 |
| 5 | coinbasecartel | 44 | 5.5% | 33 | +11 |
| 6 | akira | 39 | 4.9% | 46 | −7 |
| 7 | lockbit5 | 38 | 4.8% | 49 | −11 |
| 8 | incransom | 34 | 4.3% | 50 | −16 |
| 9 | krybit | 22 | 2.8% | 2 | +20 |
| 10 | shinyhunters | 20 | 2.5% | 16 | +4 |
| 11 | nightspire | 20 | 2.5% | 66 | −46 |
| 12 | payload | 18 | 2.3% | 21 | −3 |
| 13 | lamashtu | 17 | 2.1% | 0 | +17 |
| 14 | gunra | 16 | 2.0% | 0 | +16 |
| 15 | SilentRansomGroup | 13 | 1.6% | 6 | +7 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 162 | 20.4% |
| 2 | Manufacturing | 111 | 14.0% |
| 3 | Healthcare | 78 | 9.8% |
| 4 | Consumer Services | 71 | 8.9% |
| 5 | Technology | 67 | 8.4% |
| 6 | Financial Services | 37 | 4.7% |
| 7 | Construction | 37 | 4.7% |
| 8 | Agriculture and Food Production | 32 | 4.0% |
| 9 | Transportation/Logistics | 30 | 3.8% |
| 10 | Public Sector | 29 | 3.7% |
| 11 | Energy | 29 | 3.7% |
| 12 | Education | 25 | 3.1% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| shadowbyt3$ | Apr 1, 2026 |
| netrunner | Apr 3, 2026 |
| TiMc | Apr 9, 2026 |
| lamashtu | Apr 11, 2026 |
| LeakBazaar | Apr 13, 2026 |
| titan | Apr 14, 2026 |
| aurora | Apr 17, 2026 |
| m3rx | Apr 29, 2026 |
| mnt6 | Apr 30, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| TOWERPOINT WEALTH, LLC | shinyhunters | US | Apr 30, 2026 |
| Follett Software LLC | shinyhunters | US | Apr 30, 2026 |
| Silfab Solar | mnt6 | CA | Apr 30, 2026 |
| MES Hybrid Document Systems | qilin | CA | Apr 30, 2026 |
| The Switch Enterprises | qilin | FI | Apr 30, 2026 |
| See's Candies | qilin | US | Apr 30, 2026 |
| Jayeff Construction | qilin | GB | Apr 30, 2026 |
| Zinkan & Barker Development | qilin | GB | Apr 30, 2026 |
| Apothebeauty | qilin | US | Apr 30, 2026 |
| SMTA Sherwood Mutual Telephone Association | worldleaks | US | Apr 30, 2026 |
| Liberty Mutual Insurance | everest | US | Apr 30, 2026 |
| weiss-pm.de | krybit | DE | Apr 30, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 794 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.