Bridewell: Q3 2026 ransomware leak-site victims up 80% year on year to 2,889, with manufacturing the top sector
Bridewell threat intelligence recorded 2,889 publicly disclosed ransomware victims across 111 active groups in Q3 2026. That is 80% more than the 1,609 victims in Q3 2025 and about 30% more than Q2 2026. The data comes from Ransomware.live and covers data-leak-site (DLS) postings only. It undercounts real incidents, because some victims pay without being listed. Qilin was the most active group with 362 victims, followed by Thegentlemen with 360 and Incransom with 109. Manufacturing was the most affected sector with 474 postings (16.4%), up from 274 (12.4%) in Q2. The US accounted for 34.7% of victims. The report describes a more fragmented ecosystem and assesses with moderate confidence that elevated activity will continue into Q4.
Detalhes técnicos
- Monthly postings were 970 in July, 1,064 in August (the peak) and 855 in September.
- The top 3 groups held 29% of postings, down from 32% in Q2. The top 10 held 48%, down from 56%. 47 of the 111 groups posted fewer than 10 victims.
- New groups in August were Storm (78 postings) and Direwolf (60).
- SafePay had 73 victims, and its monthly postings rose 167% from August to September (12 to 32).
- Other groups with strong month-over-month growth were Settra (+50%), LockBit5 (+75%), Clop (+4,400%, from one to 45 victims, from a very low baseline), SilentRansomGroup (+467%) and Everest (doubled).
- Technology had 363 postings and Healthcare 285. Professional Services made up 13.6%.
- The watch list for Q4 is SilentRansomGroup, Wallstreet and Vexy Ransomware, with Threeam and Termite keeping momentum from Q2.
- Ransomware activity touched 121 countries and 13 sectors.
Remediação
Bridewell advises monitoring both emerging and established RaaS operators. It says DLS-based momentum should be corroborated with wider CTI and incident telemetry.
Linha do tempo
-
Bridewell: Q3 2026 ransomware leak-site victims up 80% year on year to 2,889, with manufacturing the top sector
ler a análise desta fonte ocultar
Bridewell threat intelligence recorded 2,889 publicly disclosed ransomware victims across 111 active groups in Q3 2026. That is 80% more than the 1,609 victims in Q3 2025 and about 30% more than Q2 2026. The data comes from Ransomware.live and covers data-leak-site (DLS) postings only. It undercounts real incidents, because some victims pay without being listed. Qilin was the most active group with 362 victims, followed by Thegentlemen with 360 and Incransom with 109. Manufacturing was the most affected sector with 474 postings (16.4%), up from 274 (12.4%) in Q2. The US accounted for 34.7% of victims. The report describes a more fragmented ecosystem and assesses with moderate confidence that elevated activity will continue into Q4.
Technical Details
- Monthly postings were 970 in July, 1,064 in August (the peak) and 855 in September.
- The top 3 groups held 29% of postings, down from 32% in Q2. The top 10 held 48%, down from 56%. 47 of the 111 groups posted fewer than 10 victims.
- New groups in August were Storm (78 postings) and Direwolf (60).
- SafePay had 73 victims, and its monthly postings rose 167% from August to September (12 to 32).
- Other groups with strong month-over-month growth were Settra (+50%), LockBit5 (+75%), Clop (+4,400%, from one to 45 victims, from a very low baseline), SilentRansomGroup (+467%) and Everest (doubled).
- Technology had 363 postings and Healthcare 285. Professional Services made up 13.6%.
- The watch list for Q4 is SilentRansomGroup, Wallstreet and Vexy Ransomware, with Threeam and Termite keeping momentum from Q2.
- Ransomware activity touched 121 countries and 13 sectors.
Remediation
Bridewell advises monitoring both emerging and established RaaS operators. It says DLS-based momentum should be corroborated with wider CTI and incident telemetry.