Ransomware attacks in July 2026
1,003 victims · 69 active groups · 9 new groups · 764 in June 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 1,003 ransomware victims claimed on leak sites in July 2026, up 31.3% from 764 in June 2026.
- 69 groups posted at least one victim; the three most active groups, thegentlemen (137), qilin (127) and Deadlock (84), accounted for 34.7% of the total.
- thegentlemen was the most active group with 137 victims, up from 117 in June 2026.
- Manufacturing was the most-targeted sector with 142 victims (14.2% of the month's total), ahead of Technology (115).
- Organizations in the United States accounted for 341 victims (34.0%), followed by Germany (58) and the United Kingdom (37); 52 victims did not disclose a location.
- 9 groups appeared in HackerFeeds data for the first time this month, including Gammax, majinahanashi and ZaWoo.
Daily activity
Busiest day: Jul 10 (104 victims). Quietest day: Jul 5 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | June 2026 | Change |
|---|---|---|---|---|---|
| 1 | thegentlemen | 137 | 13.7% | 117 | +20 |
| 2 | qilin | 127 | 12.7% | 79 | +48 |
| 3 | Deadlock | 84 | 8.4% | 8 | +76 |
| 4 | dragonforce | 43 | 4.3% | 25 | +18 |
| 5 | incransom | 38 | 3.8% | 31 | +7 |
| 6 | CRPxO | 36 | 3.6% | 0 | +36 |
| 7 | safepay | 32 | 3.2% | 21 | +11 |
| 8 | nightspire | 32 | 3.2% | 17 | +15 |
| 9 | Global Secret Group | 31 | 3.1% | 0 | +31 |
| 10 | krybit | 25 | 2.5% | 20 | +5 |
| 11 | akira | 25 | 2.5% | 31 | −6 |
| 12 | nova | 21 | 2.1% | 29 | −8 |
| 13 | everest | 20 | 2.0% | 1 | +19 |
| 14 | Section9 | 20 | 2.0% | 0 | +20 |
| 15 | settra | 18 | 1.8% | 26 | −8 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 142 | 14.2% |
| 2 | Technology | 115 | 11.5% |
| 3 | Business Services | 92 | 9.2% |
| 4 | Healthcare | 88 | 8.8% |
| 5 | Professional Services | 62 | 6.2% |
| 6 | Financial Services | 56 | 5.6% |
| 7 | Other | 42 | 4.2% |
| 8 | Retail & E-Commerce | 39 | 3.9% |
| 9 | Agriculture and Food Production | 39 | 3.9% |
| 10 | Consumer Services | 30 | 3.0% |
| 11 | Education | 27 | 2.7% |
| 12 | Hospitality | 22 | 2.2% |
Countries
52 victims (5.2%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| Gammax | Jul 3, 2026 |
| majinahanashi | Jul 4, 2026 |
| ZaWoo | Jul 6, 2026 |
| CRPxO | Jul 9, 2026 |
| D1R | Jul 13, 2026 |
| Falcon | Jul 14, 2026 |
| Global Secret Group | Jul 24, 2026 |
| Section9 | Jul 26, 2026 |
| ExfilSquad | Jul 26, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| KUVEYT TURK | CRPxO | TR | Jul 31, 2026 |
| FINANSBANK | CRPxO | TR | Jul 31, 2026 |
| ANADOLUBANK | CRPxO | TR | Jul 31, 2026 |
| THY | CRPxO | TR | Jul 31, 2026 |
| JOHNSON & JOHNSON | CRPxO | US | Jul 31, 2026 |
| DOĞAN HOLDİNG | CRPxO | TR | Jul 31, 2026 |
| ANADOLU SİGORTA | CRPxO | TR | Jul 31, 2026 |
| HYUNDAI | CRPxO | KR | Jul 31, 2026 |
| ASELSAN | CRPxO | TR | Jul 31, 2026 |
| A101 | CRPxO | TR | Jul 31, 2026 |
| Leviton | Dark Project | US | Jul 31, 2026 |
| Community Management Associates | qilin | US | Jul 31, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 1,003 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.