Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2024-06-29 → 2024-07-05 UTC
Choose a report date
Previous week Next week
Observed events
84
Public claims in the selected week
Data leak indicators
56
66.7% of observed events
Active actors
29
Distinct groups with observed activity
Torrent-linked events
3
Events intersecting with torrent intelligence

What changed this week?

•
RansomHub generated the highest visible claim volume this week, representing 11.9% of observed events.
•
66.7% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
IT Services and IT Consulting was the most represented sector in this window with 6 observed events.
•
5 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
3 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2024-07-05 UTC.
Leak sites observed this week
29
Leak sites online near report date
0
Threat actor profiles updated this week
5
Countries represented this week
24
Sectors represented this week
45

Top active actors

By observed claim volume
RansomHub
10 events · 9 leak indicators
DragonForce
7 events · 6 leak indicators
LockBit 3.0
7 events · 6 leak indicators
Akira
6 events · 3 leak indicators
INC Ransom
6 events · 6 leak indicators
PLAY
6 events · 6 leak indicators
DarkVault
4 events · 4 leak indicators
Hunters International
4 events · 4 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days
  • Brain Cipher 1 event
  • Defray777 1 event
  • Donut Leaks 1 event
  • Kill Security 1 event
  • Pryx 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States38
  • PLAY6 events · 6 leak indicators
  • INC Ransom5 events · 5 leak indicators
  • RansomHub4 events · 3 leak indicators
  • BianLian3 events · 0 leak indicators
  • DragonForce3 events · 2 leak indicators
  • LockBit 3.03 events · 3 leak indicators
  • Akira2 events · 2 leak indicators
  • Hunters International2 events · 2 leak indicators
Canada6
  • Space Bears3 events · 0 leak indicators
  • Hunters International1 event · 1 leak indicator
  • RansomHub1 event · 1 leak indicator
  • WikiLeaksV21 event · 1 leak indicator
United Kingdom5
  • DragonForce2 events · 2 leak indicators
  • Akira1 event · 0 leak indicators
  • Embargo1 event · 0 leak indicators
  • INC Ransom1 event · 1 leak indicator
Germany4
  • BlackBasta1 event · 0 leak indicators
  • Defray7771 event · 1 leak indicator
  • LockBit 3.01 event · 1 leak indicator
  • RansomHub1 event · 1 leak indicator
Italy3
  • Akira1 event · 0 leak indicators
  • Arcus Media1 event · 0 leak indicators
  • RansomHub1 event · 1 leak indicator
Australia2
  • DragonForce1 event · 1 leak indicator
  • Medusa1 event · 1 leak indicator
Brazil2
  • Akira1 event · 1 leak indicator
  • DarkVault1 event · 1 leak indicator
Croatia2
  • Blackout1 event · 1 leak indicator
  • LockBit 3.01 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
IT Services and IT Consulting6
  • Akira1 event · 1 leak indicator
  • Arcus Media1 event · 0 leak indicators
  • DragonForce1 event · 1 leak indicator
  • Medusa1 event · 1 leak indicator
  • RansomHouse1 event · 0 leak indicators
  • RansomHub1 event · 1 leak indicator
Construction5
  • RansomHub2 events · 2 leak indicators
  • DragonForce1 event · 1 leak indicator
  • Hunters International1 event · 1 leak indicator
  • Underground1 event · 0 leak indicators
Government Administration5
  • INC Ransom3 events · 3 leak indicators
  • Brain Cipher1 event · 0 leak indicators
  • RansomHub1 event · 1 leak indicator
Hospitals and Health Care4
  • LockBit 3.02 events · 2 leak indicators
  • Blacksuit1 event · 1 leak indicator
  • Monti1 event · 0 leak indicators
Food and Beverage Manufacturing3
  • BlackBasta1 event · 0 leak indicators
  • Medusa1 event · 1 leak indicator
  • Qilin1 event · 1 leak indicator
Real Estate3
  • Akira1 event · 1 leak indicator
  • Donut Leaks1 event · 0 leak indicators
  • PLAY1 event · 1 leak indicator
Advertising Services2
  • DarkVault1 event · 1 leak indicator
  • Rhysida1 event · 1 leak indicator
Beverage Manufacturing2
  • Akira1 event · 1 leak indicator
  • Blackout1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.
  • 11-50 employees 19
  • 201-500 employees 15
  • 51-200 employees 14
  • 1,001-5,000 employees 10
  • 2-10 employees 6
  • 501-1,000 employees 6

Notable actor profile updates

Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.
Actor Sector Country Leak proof Seen
Qilin Law Practice United States Data leak 2024-07-05
INC Ransom Business Consulting and Services United States Data leak 2024-07-05
INC Ransom Government Administration United States Data leak 2024-07-05
Blacksuit Hospitals and Health Care South Africa Data leak 2024-07-05
Space Bears Software Development Canada Claim only 2024-07-05
Space Bears Primary and Secondary Education Canada Claim only 2024-07-05
Space Bears Software Development Canada Claim only 2024-07-05
PLAY Mechanical Or Industrial Engineering United States Data leak 2024-07-04
PLAY Non-profit Organizations United States Data leak 2024-07-04
PLAY Paper and Forest Product Manufacturing United States Data leak 2024-07-04
PLAY Manufacturing United States Data leak 2024-07-04
PLAY Real Estate United States Data leak 2024-07-04

News and research context

Recent articles from the same time window.
Crimson Wine Group Ltd. - Form 8-K | SEC.gov 2024-07-05
Related actor: Abyss
On June 30, 2024, Crimson Wine Group, Ltd. (the “Company”) determined that the Company had experienced a cybersecurity incident in which an unauthorized third party gained access…
County Network Impacted By Ransomware 2024-07-05
Related actor: INC Ransom
Waupaca County confirmed Tuesday, July 3, that its computer “systems were impacted by ransomware.” Computers at the Waupaca County courthouse have been down since June 18. Tha…
Hiap Seng latest victim of cyber attack 2024-07-03
Hiap Seng Industries announces that it was the subject of a ransomware incident recently, where an unknown party gained unauthorised access to the company’s servers. Upon disco…
Soon Lian Holdings reports ransomware attack 2024-07-03
Soon Lian Holdings is the latest victim in a recent spate of ransomware attacks. The company announced the news on the evening of July 3. According to Soon Lian, the group t…
OCR reaches third-ever ransomware settlement 2024-07-02
Heritage Valley Health System will pay $950,000 and implement a corrective action plan as part of OCR’s third settlement involving ransomware. July 02, 2024 - The HHS Office fo…

Notes

  • Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
  • Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
  • Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
  • The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

  • The page uses a fixed seven-day window based on the selected date.
  • Only public-facing actor and event records are included.
  • Counts and breakdowns are designed for trend review, not incident confirmation.