Ransomware attacks in October 2026In progress
474 victims · 60 active groups · 2 new groups · 880 in September 2026 · Updated Oct 14, 2026
Key findings
- So far in October 2026 (through October 14 UTC), HackerFeeds has recorded 474 ransomware victims claimed on leak sites, compared with 880 in all of September 2026. The month is still in progress, so these figures are partial and will change as new claims are posted.
- 60 groups posted at least one victim; the three most active groups, N0n (66), thegentlemen (52) and qilin (50), accounted for 35.4% of the total.
- N0n was the most active group with 66 victims, against 18 in all of September 2026.
- Manufacturing was the most-targeted sector with 73 victims (15.4% of the month's total), ahead of Professional Services (54).
- Organizations in the United States accounted for 141 victims (29.7%), followed by Brazil (20) and Canada (17); 62 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: Scarlettgroup and UmBra.
Daily activity
Busiest day: Oct 5 (67 victims). Quietest day: Oct 3 (14 victims). Victims were posted on 14 of 14 days.
Most active groups
| # | Group | Victims | Share | September 2026 | Change |
|---|---|---|---|---|---|
| 1 | N0n | 66 | 13.9% | 18 | — |
| 2 | thegentlemen | 52 | 11.0% | 107 | — |
| 3 | qilin | 50 | 10.5% | 74 | — |
| 4 | safepay | 18 | 3.8% | 32 | — |
| 5 | Wallstreet | 17 | 3.6% | 16 | — |
| 6 | akira | 15 | 3.2% | 35 | — |
| 7 | incransom | 14 | 3.0% | 28 | — |
| 8 | krybit | 12 | 2.5% | 34 | — |
| 9 | interlock | 11 | 2.3% | 6 | — |
| 10 | SilentRansomGroup | 11 | 2.3% | 18 | — |
| 11 | emperador | 10 | 2.1% | 23 | — |
| 12 | UmBra | 10 | 2.1% | 0 | — |
| 13 | rhysida | 9 | 1.9% | 12 | — |
| 14 | nightspire | 9 | 1.9% | 9 | — |
| 15 | Storm | 9 | 1.9% | 37 | — |
Change is not shown while the month is in progress, as partial counts are not comparable with a full month.
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 73 | 15.4% |
| 2 | Professional Services | 54 | 11.4% |
| 3 | Transportation | 53 | 11.2% |
| 4 | Other | 51 | 10.8% |
| 5 | Healthcare | 51 | 10.8% |
| 6 | Technology | 46 | 9.7% |
| 7 | Education | 27 | 5.7% |
| 8 | Retail & E-Commerce | 19 | 4.0% |
| 9 | Financial Services | 14 | 3.0% |
| 10 | Energy & Utilities | 14 | 3.0% |
| 11 | Agriculture and Food Production | 9 | 1.9% |
| 12 | Hospitality | 8 | 1.7% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 141 | 29.7% |
| 2 | Brazil | 20 | 4.2% |
| 3 | Canada | 17 | 3.6% |
| 4 | Germany | 15 | 3.2% |
| 5 | India | 14 | 3.0% |
| 6 | United Kingdom | 14 | 3.0% |
| 7 | Spain | 14 | 3.0% |
| 8 | Sweden | 12 | 2.5% |
| 9 | South Korea | 12 | 2.5% |
| 10 | Mexico | 10 | 2.1% |
| 11 | France | 9 | 1.9% |
| 12 | Singapore | 7 | 1.5% |
| 13 | Japan | 7 | 1.5% |
| 14 | Switzerland | 7 | 1.5% |
| 15 | Taiwan | 6 | 1.3% |
62 victims (13.1%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| Scarlettgroup | Oct 5, 2026 |
| UmBra | Oct 6, 2026 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims so far
| Victim | Group | Country | Date |
|---|---|---|---|
| MOA Architecture | qilin | SG | Oct 14, 2026 |
| Joliet Public Schools District 86 | qilin | US | Oct 14, 2026 |
| Trieschmann Dumala Architectural Group | N0n | — | Oct 14, 2026 |
| Green Clinic | Wallstreet | US | Oct 14, 2026 |
| E-Z Pack Trucks | Wallstreet | US | Oct 14, 2026 |
| saintpierredescorps.fr | lockbit5 | FR | Oct 14, 2026 |
| poolegroup.com.au | lockbit5 | AU | Oct 14, 2026 |
| kordhotels.gr | lockbit5 | GR | Oct 14, 2026 |
| MyM ODONTOCLINICA S.A | emperador | BR | Oct 14, 2026 |
| Lane Equipment | dragonforce | US | Oct 14, 2026 |
| Estrategias BigMat S.L.U. | aurora | ES | Oct 14, 2026 |
| Company #65 | N0n | BR | Oct 13, 2026 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 474 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.