Ransomware attacks in June 2026
764 victims · 71 active groups · 8 new groups · 742 in May 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 764 ransomware victims claimed on leak sites in June 2026, up 3.0% from 742 in May 2026.
- 71 groups posted at least one victim; the three most active groups, thegentlemen (117), qilin (79) and lockbit5 (47), accounted for 31.8% of the total.
- thegentlemen was the most active group with 117 victims, up from 77 in May 2026.
- Business Services was the most-targeted sector with 122 victims (16.0% of the month's total), ahead of Manufacturing (84).
- Organizations in the United States accounted for 211 victims (27.6%), followed by Germany (53) and the United Kingdom (24); 98 victims did not disclose a location.
- 8 groups appeared in HackerFeeds data for the first time this month, including settra, Dark Project and xpl0itrs.
Daily activity
Busiest day: Jun 15 (57 victims). Quietest day: Jun 7 (1 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | May 2026 | Change |
|---|---|---|---|---|---|
| 1 | thegentlemen | 117 | 15.3% | 77 | +40 |
| 2 | qilin | 79 | 10.3% | 112 | −33 |
| 3 | lockbit5 | 47 | 6.2% | 22 | +25 |
| 4 | incransom | 31 | 4.1% | 29 | +2 |
| 5 | akira | 31 | 4.1% | 33 | −2 |
| 6 | nova | 29 | 3.8% | 21 | +8 |
| 7 | settra | 26 | 3.4% | 0 | +26 |
| 8 | dragonforce | 25 | 3.3% | 56 | −31 |
| 9 | stormous | 24 | 3.1% | 10 | +14 |
| 10 | shinyhunters | 22 | 2.9% | 8 | +14 |
| 11 | safepay | 21 | 2.7% | 24 | −3 |
| 12 | krybit | 20 | 2.6% | 13 | +7 |
| 13 | nightspire | 17 | 2.2% | 25 | −8 |
| 14 | pear | 16 | 2.1% | 7 | +9 |
| 15 | threeam | 14 | 1.8% | 8 | +6 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 122 | 16.0% |
| 2 | Manufacturing | 84 | 11.0% |
| 3 | Technology | 70 | 9.2% |
| 4 | Consumer Services | 61 | 8.0% |
| 5 | Healthcare | 59 | 7.7% |
| 6 | Agriculture and Food Production | 37 | 4.8% |
| 7 | Construction | 32 | 4.2% |
| 8 | Transportation/Logistics | 26 | 3.4% |
| 9 | Public Sector | 26 | 3.4% |
| 10 | Financial Services | 22 | 2.9% |
| 11 | Education | 22 | 2.9% |
| 12 | Hospitality and Tourism | 21 | 2.7% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| settra | Jun 2, 2026 |
| Dark Project | Jun 8, 2026 |
| xpl0itrs | Jun 12, 2026 |
| Wallstreet | Jun 16, 2026 |
| Booba Project | Jun 24, 2026 |
| Majinahanashi | Jun 27, 2026 |
| Redact | Jun 28, 2026 |
| Blackfield | Jun 29, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| horizoneye.com | incransom | US | Jun 30, 2026 |
| SDEZ | thegentlemen | FR | Jun 30, 2026 |
| Western Construction | play | US | Jun 30, 2026 |
| universalplant.com | chaos | US | Jun 30, 2026 |
| paipharma.com | BrainCipher | BR | Jun 30, 2026 |
| Pou Sheng International | thegentlemen | TW | Jun 30, 2026 |
| FAC Logistique | thegentlemen | FR | Jun 30, 2026 |
| Melcor Developments Ltd | thegentlemen | CA | Jun 30, 2026 |
| CUI Agency | thegentlemen | US | Jun 30, 2026 |
| Wacha Justen | thegentlemen | NI | Jun 30, 2026 |
| Oron Law Firm | thegentlemen | CH | Jun 30, 2026 |
| The City of Boyne City | thegentlemen | US | Jun 30, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 764 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.