7,655 Ransomware Claims in One Year: Group, Sector, and Country Breakdown

Summary

31 March 2026 · 6 min read · By Chris McCabe 7,655 Ransomware victim claims from 129 groups across 141 countries, March 2025 to March 2026 From March 2025 to March 2026, ransomware groups posted 7,655 victim claims to public leak sites over 376 days. That is roughly 20 per day, or one new organisation named every 71 minutes. This article breaks down which groups are most active, what sectors they target, where the victims are located, and how claim volume has changed over the observation period. All figures are based on leak site postings ingested by CipherCue via the ransomware.live API. Claim counts are not confirmed breaches. They represent what threat actors have publicly stated. One group posted 1,179 claims. Five groups account for 40%. Of 129 active groups, the top five posted 3,027 of the 7,655 claims (40%). The drop-off from there is gradual: the 6th group posted 261 claims (3.4%) and the 10th posted 191 (2.5%). GroupClaimsShareCountries Qilin1,17915.4%74 Akira7069.2%42 INC Ransom4155.4%60 Play3865.0%21 Safepay3414.5%31 Sinobi2613.4%21 DragonForce2513.3%36 Clop2483.2%36 TheGentlemen1922.5%55 Lynx1912.5%28 Qilin alone posted 1,179 claims, roughly 3.1 per day. Its geographic footprint spans 74 countries, the widest of any group. Top Qilin targets by country: US (438), France (55), Canada (48), Spain (41), Great Britain (36). This is not a group that picks one geography and stays there. Akira is second at 706 claims across 42 countries, but with a heavier US concentration: 403 of its 706 claims (57%) targeted American organisations. Germany (34), Canada (31), and Italy (20) follow. Play is the most US-concentrated of the top five. 249 of its 386 claims (64%) targeted the US, followed by Canada (27). Only 21 countries appear in its claim list, compared to Qilin's 74. The long tail matters as much as the leaders: the remaining 124 groups collectively posted 4,628 claims. This suggests that disrupting any single group is unlikely to reduce the overall total signi...