Ransomware attacks in September 2026
880 victims · 80 active groups · 10 new groups · 1,136 in August 2026 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 880 ransomware victims claimed on leak sites in September 2026, down 22.5% from 1,136 in August 2026.
- 80 groups posted at least one victim; the three most active groups, thegentlemen (107), qilin (74) and Storm (37), accounted for 24.8% of the total.
- thegentlemen was the most active group with 107 victims, down from 116 in August 2026.
- Manufacturing was the most-targeted sector with 144 victims (16.4% of the month's total), ahead of Technology (103).
- Organizations in the United States accounted for 287 victims (32.6%), followed by Germany (35) and the United Kingdom (31); 104 victims did not disclose a location.
- 10 groups appeared in HackerFeeds data for the first time this month, including BlackLocks, Vexy Ransomware and VYPR.
Daily activity
Busiest day: Sep 29 (56 victims). Quietest day: Sep 26 (3 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | August 2026 | Change |
|---|---|---|---|---|---|
| 1 | thegentlemen | 107 | 12.2% | 116 | −9 |
| 2 | qilin | 74 | 8.4% | 165 | −91 |
| 3 | Storm | 37 | 4.2% | 41 | −4 |
| 4 | akira | 35 | 4.0% | 33 | +2 |
| 5 | krybit | 34 | 3.9% | 36 | −2 |
| 6 | safepay | 32 | 3.6% | 12 | +20 |
| 7 | AuditTeam | 30 | 3.4% | 6 | +24 |
| 8 | incransom | 28 | 3.2% | 43 | −15 |
| 9 | clop | 25 | 2.8% | 88 | −63 |
| 10 | emperador | 23 | 2.6% | 11 | +12 |
| 11 | lockbit5 | 19 | 2.2% | 22 | −3 |
| 12 | Vexy Ransomware | 19 | 2.2% | 0 | +19 |
| 13 | settra | 18 | 2.0% | 27 | −9 |
| 14 | metaencryptor | 18 | 2.0% | 7 | +11 |
| 15 | SilentRansomGroup | 18 | 2.0% | 20 | −2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 144 | 16.4% |
| 2 | Technology | 103 | 11.7% |
| 3 | Professional Services | 97 | 11.0% |
| 4 | Healthcare | 85 | 9.7% |
| 5 | Other | 80 | 9.1% |
| 6 | Retail & E-Commerce | 53 | 6.0% |
| 7 | Financial Services | 45 | 5.1% |
| 8 | Education | 37 | 4.2% |
| 9 | Transportation | 33 | 3.8% |
| 10 | Government & Defense | 28 | 3.2% |
| 11 | Agriculture and Food Production | 27 | 3.1% |
| 12 | Energy & Utilities | 25 | 2.8% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 287 | 32.6% |
| 2 | Germany | 35 | 4.0% |
| 3 | United Kingdom | 31 | 3.5% |
| 4 | Canada | 30 | 3.4% |
| 5 | Brazil | 29 | 3.3% |
| 6 | Italy | 28 | 3.2% |
| 7 | India | 24 | 2.7% |
| 8 | France | 18 | 2.0% |
| 9 | Spain | 17 | 1.9% |
| 10 | Argentina | 17 | 1.9% |
| 11 | Japan | 15 | 1.7% |
| 12 | Mexico | 13 | 1.5% |
| 13 | South Korea | 12 | 1.4% |
| 14 | South Africa | 11 | 1.3% |
| 15 | Switzerland | 11 | 1.3% |
104 victims (11.8%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| BlackLocks | Sep 1, 2026 |
| Vexy Ransomware | Sep 2, 2026 |
| VYPR | Sep 5, 2026 |
| HYFLOCK | Sep 9, 2026 |
| Spirals | Sep 18, 2026 |
| EndZone | Sep 18, 2026 |
| N0n | Sep 18, 2026 |
| ImNotAVillain | Sep 24, 2026 |
| BYOD | Sep 29, 2026 |
| ULose | Sep 30, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Houston Thyroid & Endocrine Specialists | N0n | US | Sep 30, 2026 |
| Zelham | thegentlemen | — | Sep 30, 2026 |
| Zelham | thegentlemen | — | Sep 30, 2026 |
| wolfusofsky.de | safepay | DE | Sep 30, 2026 |
| Summit Electric Supply | Vexy Ransomware | US | Sep 30, 2026 |
| Titus | play | DE | Sep 30, 2026 |
| Airtech Mechanical Services | play | US | Sep 30, 2026 |
| Blaise C. Bender, PC | interlock | US | Sep 30, 2026 |
| P***** M***** I** | netrunner | — | Sep 30, 2026 |
| econ-tec.com | safepay | DE | Sep 30, 2026 |
| assist2enjoy.be | safepay | BE | Sep 30, 2026 |
| Dr Damiel Pugliese | lamashtu | — | Sep 30, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 880 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.