Privacy Unpacked
Menu

Claims, counted

Ransomware gangs: who claims the most attacks

Every gang’s leak-site claims by month, country and sector, and which claims were later followed by an official breach notice · updated daily

Claims, 12 months
10,538
Gangs active, 30 days
83
Most claims, 12 months
Qilin
Claims matched to a notice
410
01,0002,000Nov 23: 503 claimsDec 23: 533 claimsJan 24: 292 claimsFeb 24: 407 claimsMar 24: 411 claimsApr 24: 738 claimsMay 24: 594 claimsJun 24: 417 claimsJul 24: 432 claimsAug 24: 488 claimsSept 24: 406 claimsOct 24: 547 claimsNov 24: 696 claimsDec 24: 683 claimsJan 25: 616 claimsFeb 25: 1,014 claimsMar 25: 756 claimsApr 25: 536 claimsMay 25: 618 claimsJun 25: 512 claimsJul 25: 551 claimsAug 25: 561 claimsSept 25: 632 claimsOct 25: 868 claimsNov 25: 741 claimsDec 25: 898 claimsJan 26: 704 claimsFeb 26: 808 claimsMar 26: 849 claimsApr 26: 865 claimsMay 26: 787 claimsJun 26: 711 claimsJul 26: 952 claimsAug 26: 1,209 claimsSept 26: 881 claimsOct 26: 1,006 claims so farNov 23Jan 24Jan 25Jan 26
Claims by all gangs, per month, last 3 years. The last bar is the month so far.

Gangs with claims in the last 12 months

Gang12 months30 daysLast claimMost claimed countryMatched to a notice
Qilin1,53912227 October 2026United States16
The Gentlemen95911824 October 2026United States4
Akira6063428 October 2026United States35
INC Ransom4733122 October 2026United States18
DragonForce392927 October 2026United States3
LockBit 5.03902223 October 2026United States1
Cl0p342121 October 2026United States30
NightSpire2893318 October 2026United States2
Play2862327 October 2026United States15
SafePay2552512 October 2026United States1
Coinbasecartel181–23 August 2026United States1
Sinobi169–8 May 2026United States4
N0n16715328 October 2026United States–
Krybit1671424 October 2026Mexico–
Everest1572527 October 2026United States8
Nova122–25 July 2026United States–
Shinyhunters119130 September 2026United States13
Genesis113528 October 2026United States6
Deadlock109824 October 2026Italy–
Silentransomgroup992128 October 2026United States6
Devman97–4 February 2026United States–
Direwolf95327 October 2026United States1
Anubis94425 October 2026United States4
Settra941718 October 2026United States1
Payoutsking89624 October 2026United States5
Storm892219 October 2026United States3
Pear87723 October 2026United States8
World Leaks84–21 July 2026United States6
Payload83928 October 2026Germany–
Apt7380–24 July 2026United States–
Lynx78–29 August 2026United States5
Chaos77523 October 2026United States5
Rhysida761728 October 2026United States15
Handala75–8 April 2026Israel–
Spacebears68322 October 2026United States1
Interlock681421 October 2026United States5
RansomHouse66413 October 2026United States3
Auditteam601226 October 2026Russia–
Braincipher571721 October 2026United States–
Emperador562727 October 2026Brazil–
Orova56923 October 2026United States–
Aurora541628 October 2026United States1
Lamashtu542024 October 2026Germany–
Medusalocker5365 October 2026United States–
Global Secret Group53528 October 2026United States–
Insomnia5315 October 2026United States–
Ailock51–26 August 2026United States–
Majinahanashi492726 October 2026Italy–
Booba Project472327 October 2026United States1
Panzer461228 October 2026Germany–
Wallstreet452127 October 2026United States2
Kairos44414 October 2026United States2
M3rx44629 September 2026United States–
Tengu43–7 March 2026India–
Cmdorganization43–31 July 2026United States–
Crpxo37–2 August 2026United States1
Threeam3689 October 2026United States–
Dark Project36620 October 2026United States–
KillSec35–18 September 2026United States1
Gunra35–4 September 2026South Korea–
Bravox34522 October 2026United States2
Beast32–10 September 2026United States1
Stormous31–28 June 2026United States1
Fulcrumsec29223 October 2026United States–
Blacknevas28115 October 2026United States–
L Group28–23 August 2026United States–
Termite2729 October 2026United States2
Metaencryptor26212 October 2026United States–
Blackshrantac26–20 January 2026United States1
Titan26–22 September 2026Italy–
Zawoo25–24 September 2026Germany–
Vect25–15 April 2026United States–
Medusa24–14 February 2026United States12
Vexy Ransomware24717 October 2026India–
Shadowbyt3$22–16 September 2026United States–
Securotrop21–18 September 2026United States–
Lapsus$21–23 June 2026United States–
Kazu21–7 September 2026United States–
Arcusmedia2039 October 2026Brazil–
Eclipse201017 October 2026Singapore–
Crypto2419227 October 2026United States–
Doommageddon18626 October 2026Türkiye–
Warlock17–6 November 2025United States–
Helix17921 October 2026United States–
Tridentlocker17–4 September 2026United States–
Alp-00117–8 April 2026United States–
Nitrogen16119 October 2026United States1
Whitearmor161628 October 2026United States–
Iah647716818 October 2026United States–
Cloak15218 October 2026United States1
Obscura15–11 January 2026United States–
Morpheus1511 October 2026United States–
Barracuda15328 October 2026United States–
Exfilsquad15–26 July 2026United States1
Black X1439 October 2026South Korea–
Orion14–5 August 2026United States–
Benzona14–30 January 2026Romania–
Unsafe12–21 September 2026United States–
Byod121227 October 2026United States–
Netrunner1268 October 2026United States1
Icarus12–23 June 2026United States–
Hyflock111125 October 2026United States–
Dysphor1a11–6 September 2026Myanmar (Burma)–
Blackwater11–24 August 2026China–
Embargo10–9 September 2026United States4
Umbra101010 October 2026Egypt–
59 more gangs with fewer than 10 claims
  • Leakbazaar 9 in 12 months · last 10 May 2026
  • Sarcoma 8 in 12 months · last 23 October 2026
  • Global 8 in 12 months · last 12 September 2026
  • Moneymessage 8 in 12 months · last 21 September 2026
  • Brotherhood 8 in 12 months · last 6 January 2026
  • Ulose 8 in 12 months · last 27 October 2026
  • Redact 8 in 12 months · last 19 October 2026
  • The Seven Deadly Sins 8 in 12 months · last 16 October 2026
  • Xpl0itrs 8 in 12 months · last 20 August 2026
  • Abyss 7 in 12 months · last 26 August 2026
  • Endzone 7 in 12 months · last 6 October 2026
  • Vypr 7 in 12 months · last 5 October 2026
  • Gammax 7 in 12 months · last 29 September 2026
  • Alphalocker 6 in 12 months · last 28 February 2026
  • Secp0 6 in 12 months · last 22 September 2026
  • Falcon 6 in 12 months · last 26 October 2026
  • Scarlettgroup 6 in 12 months · last 26 October 2026
  • Cipherforce 6 in 12 months · last 23 February 2026
  • Ciphbit 5 in 12 months · last 10 February 2026
  • Radar 5 in 12 months · last 29 April 2026
  • Exitium 5 in 12 months · last 10 October 2026
  • Cry0 5 in 12 months · last 9 October 2026
  • Spirals 5 in 12 months · last 3 October 2026
  • Ms13089 5 in 12 months · last 15 August 2026
  • Prinzeugen 5 in 12 months · last 28 June 2026
  • 0day Syndicate 5 in 12 months · last 29 May 2026
  • Minteye 5 in 12 months · last 12 December 2025
  • Triple X 4 in 12 months · last 5 August 2026
  • RansomEXX 3 in 12 months · last 20 June 2026
  • Blackout 3 in 12 months · last 19 July 2026
  • Linkc 3 in 12 months · last 8 April 2026
  • Blacklocks 3 in 12 months · last 26 September 2026
  • Ethics 3 in 12 months · last 12 August 2026
  • D1r 3 in 12 months · last 13 July 2026
  • Mnt6 3 in 12 months · last 2 May 2026
  • Timc 3 in 12 months · last 9 April 2026
  • J 2 in 12 months · last 9 November 2025
  • Datacarry 2 in 12 months · last 6 December 2025
  • Mimori 2 in 12 months · last 20 October 2026
  • Imnotavillain 2 in 12 months · last 24 September 2026
  • Bluewhale 2 in 12 months · last 14 August 2026
  • Blackfield 2 in 12 months · last 3 July 2026
  • Kittykatkrew 2 in 12 months · last 25 February 2026
  • The Green Blood Group 2 in 12 months · last 4 February 2026
  • Osiris 2 in 12 months · last 9 January 2026
  • LockBit 3.0 1 in 12 months · last 5 December 2025
  • Kraken 1 in 12 months · last 13 November 2025
  • Skira 1 in 12 months · last 18 November 2025
  • Radiant 1 in 12 months · last 29 October 2025
  • Runsomewares 1 in 12 months · last 8 October 2026
  • Orca 1 in 12 months · last 27 April 2026
  • Atomsilo 1 in 12 months · last 24 February 2026
  • Kryptos 1 in 12 months · last 6 November 2025
  • 0x00 1 in 12 months · last 15 October 2026
  • Sovcali 1 in 12 months · last 9 August 2026
  • Kyber 1 in 12 months · last 30 July 2026
  • Loki 1 in 12 months · last 12 March 2026
  • Reynolds 1 in 12 months · last 11 February 2026
  • Sicarii 1 in 12 months · last 5 January 2026

Gone quiet

Gangs with no claim in 12 months, latest first. Gangs often stop after police action, or come back under a new name.

  • Daixin 21 claims · last 11 September 2025
  • Cicada3301 75 claims · last 4 September 2025
  • Underground 26 claims · last 15 August 2025
  • Flocker 59 claims · last 31 July 2025
  • BlackByte 147 claims · last 30 July 2025
  • Blacklock 64 claims · last 2 July 2025
  • Frag 30 claims · last 12 June 2025
  • BlackSuit 184 claims · last 2 June 2025
  • Hunters International 307 claims · last 27 May 2025
  • Monti 110 claims · last 8 May 2025
  • Babuk2 180 claims · last 23 April 2025
  • Hellcat 20 claims · last 10 April 2025
  • RansomHub 842 claims · last 31 March 2025
  • BianLian 552 claims · last 31 March 2025
  • Cactus 248 claims · last 21 March 2025
  • Fog 189 claims · last 20 March 2025
  • Funksec 172 claims · last 18 March 2025
  • 8Base 455 claims · last 1 February 2025
  • Eldorado 112 claims · last 22 January 2025
  • Black Basta 523 claims · last 11 January 2025
  • Darkvault 55 claims · last 6 January 2025
  • Raworld 126 claims · last 28 December 2024
  • Dragonransomware 39 claims · last 17 December 2024
  • Meow 145 claims · last 19 November 2024
  • Helldown 36 claims · last 6 November 2024
  • Dan0n 33 claims · last 23 August 2024
  • Dispossessor 344 claims · last 11 August 2024
  • Donutleaks 42 claims · last 24 July 2024
  • Mallox 49 claims · last 15 July 2024
  • Snatch 142 claims · last 16 May 2024
  • Trigona 49 claims · last 30 March 2024
  • Werewolves 26 claims · last 13 March 2024
  • ALPHV (BlackCat) 731 claims · last 3 March 2024
  • Knight 48 claims · last 12 February 2024
  • Cuba 103 claims · last 1 February 2024
  • Toufan 117 claims · last 27 December 2023
  • Lorenz 78 claims · last 11 December 2023
  • NoEscape 126 claims · last 4 December 2023
  • Ransomed 68 claims · last 30 October 2023
  • Arvinclub 35 claims · last 15 October 2023

What a claim is, and is not

A claim is a ransomware gang naming an organisation on its leak site, usually to pressure it into paying. It is the gang’s word: some claims are false, recycled from older breaches or exaggerated, and a claim says nothing about whose personal data, if any, was taken. That is why we count claims but do not list the organisations, and why a breach goes on the tracker as confirmed only when the organisation or a regulator says so.

How this is counted

Claims as collected from the gangs’ leak sites by ransomware.live, which says itself that they are unverified. We read its list every day and keep only counts: by month, by the victim’s country and by sector (as ransomware.live classifies them). Matches with official notices are by the organisation’s name, from 30 days before the claim to a year after it, against California’s and Washington’s full breach registers and every official notice on the tracker. A match is not a confirmation rate: those registers only see breaches of their own residents, and names are written differently. We never link to or visit leak sites.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Found a mistake? Tell us and we correct it.