Ransomware attacks in August 2026
1,136 victims · 85 active groups · 10 new groups · 1,003 in July 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 1,136 ransomware victims claimed on leak sites in August 2026, up 13.3% from 1,003 in July 2026.
- 85 groups posted at least one victim; the three most active groups, qilin (165), thegentlemen (116) and clop (88), accounted for 32.5% of the total.
- qilin was the most active group with 165 victims, up from 127 in July 2026.
- Manufacturing was the most-targeted sector with 175 victims (15.4% of the month's total), ahead of Technology (143).
- Organizations in the United States accounted for 376 victims (33.1%), followed by Germany (63) and Italy (51); 138 victims did not disclose a location.
- 10 groups appeared in HackerFeeds data for the first time this month, including Storm, Sovcali and Barracuda.
Daily activity
Busiest day: Aug 5 (104 victims). Quietest day: Aug 8 (8 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | July 2026 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 165 | 14.5% | 127 | +38 |
| 2 | thegentlemen | 116 | 10.2% | 137 | −21 |
| 3 | clop | 88 | 7.7% | 1 | +87 |
| 4 | incransom | 43 | 3.8% | 38 | +5 |
| 5 | direwolf | 43 | 3.8% | 0 | +43 |
| 6 | Storm | 41 | 3.6% | 0 | +41 |
| 7 | krybit | 36 | 3.2% | 25 | +11 |
| 8 | akira | 33 | 2.9% | 25 | +8 |
| 9 | settra | 27 | 2.4% | 18 | +9 |
| 10 | Orova | 26 | 2.3% | 8 | +18 |
| 11 | coinbasecartel | 24 | 2.1% | 5 | +19 |
| 12 | ZaWoo | 24 | 2.1% | 1 | +23 |
| 13 | lockbit5 | 22 | 1.9% | 15 | +7 |
| 14 | play | 21 | 1.8% | 13 | +8 |
| 15 | SilentRansomGroup | 20 | 1.8% | 0 | +20 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 175 | 15.4% |
| 2 | Technology | 143 | 12.6% |
| 3 | Professional Services | 127 | 11.2% |
| 4 | Healthcare | 117 | 10.3% |
| 5 | Other | 109 | 9.6% |
| 6 | Retail & E-Commerce | 66 | 5.8% |
| 7 | Financial Services | 65 | 5.7% |
| 8 | Transportation | 40 | 3.5% |
| 9 | Agriculture and Food Production | 37 | 3.3% |
| 10 | Energy & Utilities | 31 | 2.7% |
| 11 | Hospitality | 27 | 2.4% |
| 12 | Education | 26 | 2.3% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 376 | 33.1% |
| 2 | Germany | 63 | 5.5% |
| 3 | Italy | 51 | 4.5% |
| 4 | United Kingdom | 50 | 4.4% |
| 5 | Brazil | 29 | 2.6% |
| 6 | France | 26 | 2.3% |
| 7 | Canada | 26 | 2.3% |
| 8 | Mexico | 23 | 2.0% |
| 9 | India | 19 | 1.7% |
| 10 | Australia | 19 | 1.7% |
| 11 | Taiwan | 15 | 1.3% |
| 12 | Switzerland | 14 | 1.2% |
| 13 | Japan | 13 | 1.1% |
| 14 | Spain | 13 | 1.1% |
| 15 | Argentina | 13 | 1.1% |
138 victims (12.1%) did not disclose a location.
Groups seen for the first time
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| icot.es | BrainCipher | ES | Aug 31, 2026 |
| aeiconsultants.com | BrainCipher | US | Aug 31, 2026 |
| syc.es | BrainCipher | ES | Aug 31, 2026 |
| Adviesbureau De Beuckelaer BV | BrainCipher | NL | Aug 31, 2026 |
| ahadandco.com | BrainCipher | AE | Aug 31, 2026 |
| sago.com | BrainCipher | — | Aug 31, 2026 |
| crmeyer.com | BrainCipher | DE | Aug 31, 2026 |
| ccsperfusion.com | BrainCipher | US | Aug 31, 2026 |
| Inmac | qilin | AR | Aug 31, 2026 |
| The Sole | thegentlemen | GB | Aug 31, 2026 |
| Nutex Health | thegentlemen | US | Aug 31, 2026 |
| R L Fine Chem Pvt. Ltd. | Global Secret Group | IN | Aug 31, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 1,136 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.