A state cyber incident response task force and Louisiana’s Special School District (SSD) are working together to investigate a cyber incident involving the district’s system.
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2024-05-25 → 2024-05-31 UTC
Choose a report date
Observed events
68
Public claims in the selected week
Data leak indicators
49
72.1% of observed events
Active actors
20
Distinct groups with observed activity
Torrent-linked events
0
Events intersecting with torrent intelligence
What changed this week?
•
LockBit 3.0 generated the highest visible claim volume this week, representing 19.1% of observed events.
•
72.1% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Oil and Gas was the most represented sector in this window with 4 observed events.
•
2 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
2 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.
Coverage snapshot
As of 2024-05-31 UTC.
Leak sites observed this week
20
Leak sites online near report date
2
Threat actor profiles updated this week
3
Countries represented this week
21
Sectors represented this week
45
Top active actors
By observed claim volumeLockBit 3.0
13 events · 12 leak indicators
Akira
10 events · 0 leak indicators
8BASE
7 events · 7 leak indicators
PLAY
5 events · 5 leak indicators
RansomHub
4 events · 3 leak indicators
BianLian
3 events · 3 leak indicators
Cactus
3 events · 3 leak indicators
Medusa
3 events · 3 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- Blackout 1 event
- Mallox 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States30
- Akira7 events · 0 leak indicators
- PLAY4 events · 4 leak indicators
- BianLian3 events · 3 leak indicators
- LockBit 3.03 events · 2 leak indicators
- Medusa3 events · 3 leak indicators
- INC Ransom2 events · 2 leak indicators
- Qilin2 events · 2 leak indicators
- Red Ransomware2 events · 1 leak indicator
Canada4
- 8BASE1 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
- Qiulong1 event · 0 leak indicators
- Rhysida1 event · 1 leak indicator
France4
- Monti3 events · 0 leak indicators
- LockBit 3.01 event · 1 leak indicator
Japan4
- 8BASE4 events · 4 leak indicators
Belgium3
- 8BASE1 event · 1 leak indicator
- Akira1 event · 0 leak indicators
- Hunters International1 event · 1 leak indicator
Italy3
- Akira1 event · 0 leak indicators
- Cactus1 event · 1 leak indicator
- RansomHub1 event · 0 leak indicators
Spain3
- LockBit 3.02 events · 2 leak indicators
- Cactus1 event · 1 leak indicator
India2
- LockBit 3.02 events · 2 leak indicators
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Oil and Gas4
- LockBit 3.02 events · 1 leak indicator
- Qilin1 event · 1 leak indicator
- RansomHub1 event · 1 leak indicator
Medical Practice3
- INC Ransom1 event · 1 leak indicator
- LockBit 3.01 event · 1 leak indicator
- Qiulong1 event · 0 leak indicators
Accounting2
- 8BASE1 event · 1 leak indicator
- DragonForce1 event · 1 leak indicator
Architecture and Planning2
- 8BASE1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
Broadcast Media Production and Distribution2
- Akira1 event · 0 leak indicators
- PLAY1 event · 1 leak indicator
Chemical Manufacturing2
- Cactus1 event · 1 leak indicator
- Hunters International1 event · 1 leak indicator
Food and Beverage Manufacturing2
- Akira1 event · 0 leak indicators
- PLAY1 event · 1 leak indicator
Government Administration2
- LockBit 3.01 event · 1 leak indicator
- RansomHub1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 51-200 employees 21
- 11-50 employees 11
- 1,001-5,000 employees 9
- 201-500 employees 6
- 501-1,000 employees 4
- 5,001-10,000 employees 1
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| Cactus | Transportation, Logistics, Supply Chain and Storage | Spain | Data leak | 2024-05-31 |
| Cactus | Insurance | Bahamas | Data leak | 2024-05-31 |
| Cactus | Chemical Manufacturing | Italy | Data leak | 2024-05-31 |
| Akira | Broadcast Media Production and Distribution | United States | Claim only | 2024-05-31 |
| Akira | Transportation, Logistics, Supply Chain and Storage | United States | Claim only | 2024-05-31 |
| Qilin | Warehousing | Brazil | Claim only | 2024-05-31 |
| BlackBasta | Appliances, Electrical, and Electronics Manufacturing | United States | Data leak | 2024-05-31 |
| LockBit 3.0 | Government Administration | Spain | Data leak | 2024-05-30 |
| LockBit 3.0 | Oil and Gas | United States | Claim only | 2024-05-30 |
| Medusa | Automation Machinery Manufacturing | United States | Data leak | 2024-05-30 |
| Akira | Security and Investigations | United States | Claim only | 2024-05-30 |
| Medusa | Maritime | United States | Data leak | 2024-05-30 |
News and research context
Recent articles from the same time window.
Between 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.…
Update on data security incident
2024-05-29
The BBC’s information security team has alerted us to a data security incident.
The BBC’s information security team has alerted us to a data security incident, in which some fi…
Schlagartig fiel das Internet in der Kantonsschule Frauenfeld aus. Und auch der Zugang zu internen Systemen blieb den Schülerinnen und Schülern verweigert. Entsprechend kursierte…
Court systems form crucial national infrastructure and therefore a nation-state angle cannot be completely ruled out in the recent surge in attacks.
The school district informed parents they were canceling classes on Tuesday to allow time to get their systems back up and running after their network and server were infiltrated.…
The delivery company CDEK attributed disruption to its services to a “massive technical failure” but a Russian government official confirmed it was caused by a cyberattack.
In the early morning hours of Saturday, May 25 — just one day before we were prepared to take our systems offline to conduct planned maintenance on a server over Memorial Day week…
Optus has lost its bid to appeal an earlier Federal Court decision granting access to portions of a forensic review of its 2022 data breach to a law firm as part of a class action…
The Metropolitan Police Department on May 28 arrested a man on suspicion of creating a computer virus using interactive generative artificial intelligence in a potential ransomwar…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.