Ransomware Statistics 2026: Leak-Site Victim Posts Are Up a Third, With a Record August
These ransomware statistics count the victims that ransomware groups name on their own leak sites. From January to September 2026, groups posted 8,009 victims, up 33% on the same months of 2025, and August set a monthly record of 1,222. 161 groups posted at least once, and groups less than a year old posted 47% of victims.
Ransomware victims posted every month since 2021
RansomLook, deduplicated ransomwatch (archived, to December 2024, before it wound down)
Victims named on ransomware and data-extortion leak sites per month, by the date RansomLook first saw the post, January 2021 to September 2026. October 2026 is incomplete and excluded. Shaded period: trackers were still loading older posts in bulk, so counts there reflect when a site was added, not when victims were posted. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
The series shows a step up in late 2024, a jump in 2025, and a higher plateau in 2026 that peaked in August at 1,222, ahead of the previous high of 1,025 in October 2025. Some spikes are mass postings by a single group, such as Cl0p naming 235 victims on 24 February 2025 and KillSec naming 169 on 10 October 2025. The August 2026 record is different: it was spread across Qilin (165), The Gentlemen (162), Cl0p (87).
As a check, we ran the same counting rule over ransomwatch, an independent open tracker that stopped updating in mid-2025. For 2023 and 2024 it recorded 9,901 victims against 11,408 in RansomLook, 13% fewer, and its monthly counts moved with RansomLook’s (correlation 0.72).
2026 vs 2025, month by month
| Month | 2025 | 2026 | Change | 2026: share by groups under 12 months old |
|---|---|---|---|---|
| January | 695 | 788 | +13% | 43% |
| February | 999 | 826 | -17% | 46% |
| March | 805 | 930 | +16% | 40% |
| April | 672 | 832 | +24% | 54% |
| May | 501 | 763 | +52% | 40% |
| June | 520 | 840 | +62% | 54% |
| July | 620 | 843 | +36% | 47% |
| August | 542 | 1,222 | +125% | 55% |
| September | 649 | 965 | +49% | 44% |
| January to September | 6,003 | 8,009 | +33% | 47% |
Deduplicated victim posts by month first seen: the same victim name posted by the same group within 30 days is counted once. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
Every month of 2026 so far is above the same month of 2025 except February, the month of the 2025 Cl0p dump. Who is doing the posting is a separate story: two groups, Qilin and The Gentlemen, account for 24% of 2026 victims. We rank every group and profile the leaders in our companion report on the most active ransomware groups of 2026.
New groups post nearly half of all victims
groups less than 12 months old at the time of the post older groups
Age is measured from the first post RansomLook holds for each leak-site name. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
In 2026, groups that had been posting for less than a year accounted for 3,780 of 8,009 victims (47%). That share has been steady at roughly half every year since 2023 (51% in 2023, 49% in 2024, 47% in 2025), so the growth in 2026 came from new and established groups at about the same rate: young groups added 952 of the 2,006 additional victims. Some “new” names are rebrands of older operations; the data counts leak-site names, not people.
Which ransomware groups are driving the numbers
Small multiples: monthly leak-site victims for the six most active groups of 2026, since January 2025, each on its own scale. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
The six largest groups show very different shapes. The Gentlemen and LockBit 5 barely existed at the start of the window. Qilin has been large throughout and climbed further. Akira has held a steady pace rather than growing. That mix is why the totals keep rising even as individual groups come and go.
When ransomware groups post
Average victim posts per calendar day by weekday, January to September 2026; black ticks show 2025. Day is the UTC date RansomLook first saw the post; it scrapes leak sites several times a day. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
Leak-site posting follows a working week. In 2026, RansomLook first saw an average of 34 victims per weekday against 18 per Saturday or Sunday, and Monday was the busiest day at 39.5. The pattern held in 2025. For defenders, this says nothing about when intrusions happen; it shows when groups publish, which is when a victim’s name, and often its data, becomes public.
Why leak-site numbers are a floor
A leak-site post is a claim by a criminal group, typically made when a victim has not paid. Victims who pay before the deadline, and attacks that are never claimed, do not appear. Some posts are false or recycled. Treat every count on this page as a lower bound of attacks, not a census.
Post dates also trail attack dates, by an amount these data cannot measure: RansomLook records when a post appeared, not when the intrusion happened. Official counts are smaller still because they rely on victims coming forward. The FBI’s Internet Crime Complaint Center logged 3,611 ransomware complaints in 2025, up from 3,156 in 2024, a trend we track in our five-year analysis of ransomware reported to the FBI. IC3 also identified 63 new ransomware variants in 2025. CISA and the FBI publish #StopRansomware advisories on individual groups; we coded every one by entry technique in our report on ransomware initial access vectors.
Ransomware statistics by year
| Year | Leak-site victims (RansomLook) | ransomwatch (cross-check) | Groups posting | Share by groups under 12 months old | FBI IC3 ransomware complaints |
|---|---|---|---|---|---|
| 2021 | 2,315 | 1,783 | 46 | n/a | n/a |
| 2022 | 4,169 | 2,865 | 61 | n/a | n/a |
| 2023 | 5,391 | 4,748 | 71 | 51% | 2,825 |
| 2024 | 6,017 | 5,153 | 102 | 49% | 3,156 |
| 2025 | 8,795 | n/a | 140 | 47% | 3,611 |
| 2026* | 8,009 | n/a | 161 | 47% | n/a |
*2026 is January to September; the young-group share uses January to September for every year. 2021 and 2022 include bulk backfills of older posts. ransomwatch stopped updating in mid-2025. IC3 complaints from the FBI 2025 IC3 Annual Report. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
What this means for MSPs
The like-for-like growth is clear, so plan for more incidents among clients, not fewer. Three points from the data are specific enough to act on:
- Name-based threat tracking ages fast. Groups less than a year old post about half of all victims, year after year. Controls aimed at common entry points, such as patched edge devices, MFA on remote access, and tested offline backups, outlast any list of group names.
- Expect publication on weekdays. If a client is in negotiations or has refused to pay, a leak-site post is most likely to land on a weekday. Have the communications and legal contacts ready before the deadline, not after.
- Do not wait for a leak-site post. By the time a victim is named, its data has already left the network. Monitoring trackers for client and supplier names is useful for third-party risk, but it is a lagging indicator, not detection.
Frequently asked questions
How many ransomware attacks were there in 2026?
Ransomware groups posted 8,009 victims on their leak sites from January to September 2026, according to RansomLook data, up 33% on the same months of 2025. This is a lower bound of attacks: victims who pay quickly are usually never posted.
How many ransomware attacks were there in 2025?
RansomLook recorded 8,795 leak-site victim posts in 2025 after removing duplicates, a record at the time and up 46% on 6,017 in 2024.
Is ransomware increasing?
Yes, on leak-site data. Posts from January to September 2026 are up 33% on 2025, August 2026 set a monthly record of 1,222, and the number of groups posting rose from 124 to 161 over the same months. FBI complaints also rose, from 3,156 in 2024 to 3,611 in 2025.
Which ransomware groups are most active in 2026?
By leak-site victims from January to September 2026: Qilin (1,023), The Gentlemen (892), Akira (390), INC Ransom (360), DragonForce (323). The top two posted 24% of all victims.
What day of the week do ransomware groups post victims?
Weekdays, mostly. In 2026, RansomLook first saw an average of 34 victim posts per weekday against 18 per weekend day. Monday is the busiest day, at 39.5 posts on average.
How many ransomware complaints did the FBI receive in 2025?
The FBI’s Internet Crime Complaint Center received 3,611 ransomware complaints in 2025 and identified 63 new ransomware variants, according to its 2025 annual report. That is fewer than leak-site posts because it counts only victims who report to IC3.
Methodology
Source. RansomLook public API (/api/posts/{year}/{month} and /api/group-first-seen), every post January 2021 to October 2026, retrieved 2026-10-13. RansomLook content is licensed under CC BY 4.0; we deduplicated and aggregated it, and the counts on this page are our own. Cross-checks: ransomwatch posts.json (archived open project, released under the Unlicense) and the FBI 2025 IC3 Annual Report.
Counting rule. A victim is a post on a ransomware or data-extortion group’s leak site. Victim names were trimmed, whitespace-collapsed, and lowercased; the same name posted by the same group within 30 days counts once. This removed 521 of 35,619 posts. Re-posts by the same group more than 30 days apart are kept and flagged (11 in 2026 so far). We also flagged 45 2026 posts where a different group had posted the same victim name within the previous 90 days, a sign of re-extortion, affiliates switching brands, or recycled claims; each is counted once per group. Partly masked victim names appear in 41 posts from 2026; these are counted as posted.
Dates and ages. Months and weekdays use the UTC date RansomLook first saw each post. Like-for-like comparisons use January to September in both years; October 2026 was incomplete at retrieval and is excluded. A group’s age is the time since the earliest post RansomLook holds for that leak-site name.
Coverage and limitations. Leak sites undercount attacks (paying victims are rarely posted) and include some false, recycled, or exaggerated claims. Groups that rebrand appear under new names. RansomLook does not classify victims by country or industry, so this report does not break them down that way. Before 2023, trackers were still adding older leak sites in bulk.
Not advice. This is an analysis of public claims data, not a statement that any named organization was breached.
Cite as:The Uptime Report. "Ransomware Statistics 2026: Leak-Site Victim Posts Are Up a Third, With a Record August." October 2026. https://theuptimereport.com/ransomware-statistics-2026/
References
- RansomLook, public API and documentation (ransomlook.io/doc), licensed CC BY 4.0. Accessed October 2026.
- ransomwatch, posts.json (archived, Unlicense). Accessed October 2026.
- FBI Internet Crime Complaint Center, 2025 IC3 Annual Report. Accessed October 2026.
- CISA, #StopRansomware official alerts and statements. Accessed October 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend
Infrastructure and uptime
- Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version
Regulation and disclosure
- SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement
Workforce and pay
- Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections
MSP market and spending
- Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas
Leave a Reply