GoKawiilinsight
7,655 Ransomware victim claims from 129 groups across 141 countries, March 2025 to March 2026
From March 2025 to March 2026, ransomware groups posted 7,655 victim claims to public leak sites over 376 days. That is roughly 20 per day, or one new organisation named every 71 minutes.
This article breaks down which groups are most active, what sectors they target, where the victims are located, and how claim volume has changed over the observation period. All figures are based on leak site postings ingested by CipherCue via the ransomware.live API. Claim counts are not confirmed breaches. They represent what threat actors have publicly stated.
One group posted 1,179 claims. Five groups account for 40%.
Of 129 active groups, the top five posted 3,027 of the 7,655 claims (40%). The drop-off from there is gradual: the 6th group posted 261 claims (3.4%) and the 10th posted 191 (2.5%).
Group Claims Share Countries Qilin 1,179 15.4% 74 Akira 706 9.2% 42 INC Ransom 415 5.4% 60 Play 386 5.0% 21 Safepay 341 4.5% 31 Sinobi 261 3.4% 21 DragonForce 251 3.3% 36 Clop 248 3.2% 36 TheGentlemen 192 2.5% 55 Lynx 191 2.5% 28
Qilin alone posted 1,179 claims, roughly 3.1 per day. Its geographic footprint spans 74 countries, the widest of any group. Top Qilin targets by country: US (438), France (55), Canada (48), Spain (41), Great Britain (36). This is not a group that picks one geography and stays there.
Akira is second at 706 claims across 42 countries, but with a heavier US concentration: 403 of its 706 claims (57%) targeted American organisations. Germany (34), Canada (31), and Italy (20) follow.
Play is the most US-concentrated of the top five. 249 of its 386 claims (64%) targeted the US, followed by Canada (27). Only 21 countries appear in its claim list, compared to Qilin's 74.
... continue reading