Ransomware attacks in May 2026
742 victims · 65 active groups · 6 new groups · 794 in April 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 742 ransomware victims claimed on leak sites in May 2026, down 6.5% from 794 in April 2026.
- 65 groups posted at least one victim; the three most active groups, qilin (112), thegentlemen (77) and dragonforce (56), accounted for 33.0% of the total.
- qilin was the most active group with 112 victims, up from 107 in April 2026.
- Business Services was the most-targeted sector with 145 victims (19.5% of the month's total), ahead of Manufacturing (96).
- Organizations in the United States accounted for 281 victims (37.9%), followed by the United Kingdom (48) and Germany (39); 35 victims did not disclose a location.
- 6 groups appeared in HackerFeeds data for the first time this month, including fulcrumsec, Orova and Icarus.
Daily activity
Busiest day: May 1 (57 victims). Quietest day: May 16 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | April 2026 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 112 | 15.1% | 107 | +5 |
| 2 | thegentlemen | 77 | 10.4% | 87 | −10 |
| 3 | dragonforce | 56 | 7.5% | 63 | −7 |
| 4 | akira | 33 | 4.4% | 39 | −6 |
| 5 | incransom | 29 | 3.9% | 34 | −5 |
| 6 | nightspire | 25 | 3.4% | 20 | +5 |
| 7 | safepay | 24 | 3.2% | 9 | +15 |
| 8 | fulcrumsec | 23 | 3.1% | 0 | +23 |
| 9 | lockbit5 | 22 | 3.0% | 38 | −16 |
| 10 | nova | 21 | 2.8% | 8 | +13 |
| 11 | genesis | 19 | 2.6% | 1 | +18 |
| 12 | play | 16 | 2.2% | 6 | +10 |
| 13 | medusalocker | 15 | 2.0% | 0 | +15 |
| 14 | lamashtu | 15 | 2.0% | 17 | −2 |
| 15 | everest | 15 | 2.0% | 12 | +3 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 145 | 19.5% |
| 2 | Manufacturing | 96 | 12.9% |
| 3 | Technology | 61 | 8.2% |
| 4 | Healthcare | 59 | 8.0% |
| 5 | Consumer Services | 51 | 6.9% |
| 6 | Agriculture and Food Production | 38 | 5.1% |
| 7 | Financial Services | 36 | 4.9% |
| 8 | Transportation/Logistics | 32 | 4.3% |
| 9 | Construction | 29 | 3.9% |
| 10 | Education | 26 | 3.5% |
| 11 | Public Sector | 24 | 3.2% |
| 12 | Hospitality and Tourism | 19 | 2.6% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 281 | 37.9% |
| 2 | United Kingdom | 48 | 6.5% |
| 3 | Germany | 39 | 5.3% |
| 4 | Canada | 26 | 3.5% |
| 5 | Spain | 23 | 3.1% |
| 6 | Italy | 21 | 2.8% |
| 7 | Australia | 19 | 2.6% |
| 8 | Japan | 16 | 2.2% |
| 9 | Mexico | 15 | 2.0% |
| 10 | India | 14 | 1.9% |
| 11 | Netherlands | 13 | 1.8% |
| 12 | Brazil | 12 | 1.6% |
| 13 | Turkey | 11 | 1.5% |
| 14 | France | 11 | 1.5% |
| 15 | Taiwan | 9 | 1.2% |
35 victims (4.7%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| fulcrumsec | May 1, 2026 |
| Orova | May 3, 2026 |
| Icarus | May 5, 2026 |
| Triple X | May 11, 2026 |
| Deadlock | May 22, 2026 |
| 0day Syndicate | May 28, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Grupo Mauá | bravox | BR | May 31, 2026 |
| Fidelity Pension Managers | Deadlock | NG | May 31, 2026 |
| Lake Washington School District | cmdorganization | US | May 31, 2026 |
| Stellar | spacebears | TC | May 31, 2026 |
| dean cosmetic dentistry | nightspire | US | May 31, 2026 |
| tulipmediworld.com | krybit | IN | May 30, 2026 |
| Synex International Pvt Ltd | dragonforce | LK | May 30, 2026 |
| Panorama BPO | dragonforce | PH | May 30, 2026 |
| Taos Mountain Casino | dragonforce | US | May 30, 2026 |
| Cavalier Flooring Systems Inc. | genesis | US | May 30, 2026 |
| Wentworth | genesis | US | May 30, 2026 |
| Green Resource | genesis | US | May 30, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 742 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.