Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2024-06-08 → 2024-06-14 UTC

Choose a report date

Observed events

Public claims in the selected week

Data leak indicators

79.8% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

PLAY generated the highest visible claim volume this week, representing 29.8% of observed events.

•

79.8% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 9 observed events.

•

3 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

1 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2024-06-14 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

PLAY

25 events · 23 leak indicators

Eraleignews

6 events · 6 leak indicators

Cactus

5 events · 5 leak indicators

DragonForce

5 events · 5 leak indicators

Qilin

5 events · 5 leak indicators

RansomHub

5 events · 4 leak indicators

Medusa

4 events · 4 leak indicators

Akira

3 events · 1 leak indicator

Emerging or resurfacing actors

No matching activity in prior 30 days

DarkVault 3 events
Trinity 3 events
Metaencryptor 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States42

PLAY17 events · 16 leak indicators
Qilin5 events · 5 leak indicators
DragonForce3 events · 3 leak indicators
Everest2 events · 0 leak indicators
INC Ransom2 events · 2 leak indicators
Akira1 event · 0 leak indicators
Arcus Media1 event · 0 leak indicators
BianLian1 event · 1 leak indicator

Canada9

PLAY3 events · 3 leak indicators
Cactus2 events · 2 leak indicators
Medusa2 events · 2 leak indicators
INC Ransom1 event · 1 leak indicator
Trinity1 event · 0 leak indicators

United Kingdom5

Eraleignews4 events · 4 leak indicators
RansomHub1 event · 1 leak indicator

Argentina2

CL0P1 event · 0 leak indicators
PLAY1 event · 1 leak indicator

India2

DarkVault1 event · 1 leak indicator
RansomHub1 event · 1 leak indicator

Italy2

Everest1 event · 0 leak indicators
RansomHub1 event · 1 leak indicator

Netherlands2

Blacksuit1 event · 1 leak indicator
PLAY1 event · 1 leak indicator

Spain2

8BASE1 event · 1 leak indicator
Cloak1 event · 0 leak indicators

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction9

PLAY3 events · 3 leak indicators
Qilin2 events · 2 leak indicators
Akira1 event · 0 leak indicators
Cactus1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
Medusa1 event · 1 leak indicator

IT Services and IT Consulting4

PLAY2 events · 1 leak indicator
Everest1 event · 0 leak indicators
Trinity1 event · 0 leak indicators

Law Practice4

PLAY2 events · 2 leak indicators
Eraleignews1 event · 1 leak indicator
Qilin1 event · 1 leak indicator

Appliances, Electrical, and Electronics Manufacturing3

DarkVault1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
LockBit 3.01 event · 1 leak indicator

Financial Services3

CL0P1 event · 0 leak indicators
PLAY1 event · 1 leak indicator
RansomHub1 event · 1 leak indicator

Food and Beverage Manufacturing3

8BASE1 event · 1 leak indicator
Eraleignews1 event · 1 leak indicator
Rhysida1 event · 1 leak indicator

Hospitals and Health Care3

Blacksuit1 event · 1 leak indicator
Eraleignews1 event · 1 leak indicator
RansomHub1 event · 0 leak indicators

Medical Practice3

CL0P1 event · 0 leak indicators
DragonForce1 event · 1 leak indicator
Everest1 event · 0 leak indicators

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

11-50 employees 28
51-200 employees 18
201-500 employees 8
1,001-5,000 employees 7
2-10 employees 6
501-1,000 employees 4

Notable actor profile updates

Active actor records only.

New ransom note observed

No ransom-note change logged in this reporting window.

New actor infrastructure / contact channel

No infrastructure/contact-channel change logged in this reporting window.

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
Qilin	Construction	United States	Data leak	2024-06-14
Metaencryptor	Accounting	United States	Data leak	2024-06-14
Qilin	Environmental Services	United States	Data leak	2024-06-14
Akira	Farming	United States	Claim only	2024-06-14
Eraleignews	Law Practice	United Kingdom	Data leak	2024-06-14
Eraleignews	Staffing and Recruiting	Switzerland	Data leak	2024-06-13
Eraleignews	Food and Beverage Manufacturing	United Kingdom	Data leak	2024-06-13
BianLian	Higher Education	United States	Data leak	2024-06-13
RansomHub	Defense and Space Manufacturing	United Kingdom	Data leak	2024-06-13
INC Ransom	Industrial Machinery Manufacturing	Canada	Data leak	2024-06-13
Everest	Accounting	United States	Claim only	2024-06-13
Medusa	Spectator Sports	Australia	Data leak	2024-06-13

News and research context

Recent articles from the same time window.

Notice of Data Breach - Santoro Whitmire 2024-06-14

Recently, after the firm permanently closed its business, we were the target of a ransomware attack. Ransomware is a computer virus that encrypts computer systems until and unless…

Cyberattaques « Umbrella » : Un suspect interpellé en Roumanie, près d’un million d’euros de préjudice en France 2024-06-13

Ce mercredi, la procureure de Paris a annoncé qu’un suspect, lié aux attaques informatiques du rançongiciel Umbrella, a été interpellé en Roumanie.

New York Duty-Free Retailers Sued Over 2023 Ransomware Attack 2024-06-13

Related actor: LockBit 3.0

International Shoppes LLC and Diplomatic Duty Free Shops of New York Inc. were hit with a former employee’s proposed class action alleging their inadequate security practices led…

Ransomware Attack Brings Unknowns For GT County, City of TC | The Ticker 2024-06-13

What was initially described as a “significant network disruption” and later confirmed as a ransomware attack hit Grand Traverse County and the City of Traverse City Wednesday, in…

Letter Re: Cyber Incident - Toronto District School Board 2024-06-13

Related actor: LockBit 3.0

We wanted to share an important update about a cyber incident (ransomware) experienced by the Toronto District School Board (TDSB). TDSB recently became aware that an unauthorized…

Medusa’s methods: Ransomware group exploits FortiClient EMS for initial access 2024-06-12

Related actor: Medusa

The Medusa ransomware group is actively exploiting a SQL injection vulnerability (CVE-2023-48788) in FortiClient Enterprise Management Server ('FortiClient EMS') instances to gain…

The State of Ransomware in Retail 2024 – Sophos News 2024-06-12

Attack rates have dropped, but recovery is more expensive 45% of retail organizations reported they were hit by ransomware last year. This is a notable and welcome drop from th…

RansomHub Brings Scattered Spider Into Its RaaS Fold 2024-06-12

Related actor: RansomHub

The threat group behind breaches at Caesars and MGM moves its business over to a different ransomware-as-a-service operation.

Black Basta ransomware gang linked to Windows zero-day attacks 2024-06-12

Related actor: BlackBasta

The Cardinal cybercrime group (Storm-1811, UNC4394), who are the main operators of the Black Basta ransomware, is suspected of exploiting a Windows privilege escalation vulnerabil…

Ransomware: A persistent challenge in cyber insurance claims | Marsh 2024-06-11

With cyber risk firmly embedded as a key concern for organizations of all sizes, effective risk transfer is an increasingly important piece of a successful cyber risk management s…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.