Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2025-01-17 → 2025-01-23 UTC

Choose a report date

Observed events

111

Public claims in the selected week

Data leak indicators

64.9% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

CL0P generated the highest visible claim volume this week, representing 25.2% of observed events.

•

64.9% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Hospitals and Health Care was the most represented sector in this window with 8 observed events.

•

4 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2025-01-23 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

CL0P

28 events · 0 leak indicators

RansomHub

13 events · 13 leak indicators

Lynx

8 events · 8 leak indicators

INC Ransom

7 events · 7 leak indicators

Qilin

7 events · 6 leak indicators

Akira

6 events · 4 leak indicators

Medusa

6 events · 6 leak indicators

SAFEPAY

5 events · 5 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

No newly active actor families were detected using the 30-day lookback rule.

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States59

CL0P18 events · 0 leak indicators
RansomHub8 events · 8 leak indicators
INC Ransom6 events · 6 leak indicators
Lynx6 events · 6 leak indicators
Qilin5 events · 5 leak indicators
Medusa4 events · 4 leak indicators
BianLian3 events · 1 leak indicator
Akira2 events · 0 leak indicators

Australia6

CL0P2 events · 0 leak indicators
DragonForce1 event · 1 leak indicator
Lynx1 event · 1 leak indicator
Money Message1 event · 1 leak indicator
Space Bears1 event · 0 leak indicators

Canada6

CL0P3 events · 0 leak indicators
Akira1 event · 1 leak indicator
Data Leak1 event · 1 leak indicator
Lynx1 event · 1 leak indicator

India6

CL0P1 event · 0 leak indicators
Eraleignews1 event · 1 leak indicator
Kill Security1 event · 1 leak indicator
Qilin1 event · 0 leak indicators
RansomHub1 event · 1 leak indicator
Space Bears1 event · 1 leak indicator

United Kingdom5

Kairos2 events · 2 leak indicators
Sarcoma2 events · 2 leak indicators
RansomHub1 event · 1 leak indicator

Germany3

CL0P1 event · 0 leak indicators
LockBit 3.01 event · 1 leak indicator
RansomHub1 event · 1 leak indicator

Italy3

Akira1 event · 1 leak indicator
Cloak1 event · 0 leak indicators
Morpheus1 event · 0 leak indicators

Netherlands3

CL0P2 events · 0 leak indicators
Fog1 event · 0 leak indicators

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Hospitals and Health Care8

Space Bears3 events · 3 leak indicators
INC Ransom2 events · 2 leak indicators
Kairos1 event · 1 leak indicator
Medusa1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Transportation, Logistics, Supply Chain and Storage7

CL0P6 events · 0 leak indicators
Qilin1 event · 1 leak indicator

Software Development6

CL0P3 events · 0 leak indicators
Akira1 event · 1 leak indicator
BianLian1 event · 1 leak indicator
Lynx1 event · 1 leak indicator

IT Services and IT Consulting5

CL0P2 events · 0 leak indicators
LockBit 3.01 event · 1 leak indicator
Morpheus1 event · 0 leak indicators
RansomHub1 event · 1 leak indicator

Manufacturing5

RansomHub3 events · 3 leak indicators
Lynx1 event · 1 leak indicator
Qilin1 event · 0 leak indicators

Construction4

Medusa2 events · 2 leak indicators
Lynx1 event · 1 leak indicator
RansomHub1 event · 1 leak indicator

Oil and Gas4

CL0P1 event · 0 leak indicators
Hunters International1 event · 1 leak indicator
Qilin1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Banking3

CL0P1 event · 0 leak indicators
Eraleignews1 event · 1 leak indicator
RansomHub1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

51-200 employees 32
201-500 employees 22
11-50 employees 21
501-1,000 employees 10
1,001-5,000 employees 8
10,001+ employees 6

Notable actor profile updates

Active actor records only.

New ransom note observed

No ransom-note change logged in this reporting window.

New actor infrastructure / contact channel

No infrastructure/contact-channel change logged in this reporting window.

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
CL0P	Travel Arrangements	United States	Claim only	2025-01-23
CL0P	Semiconductor Manufacturing	United States	Claim only	2025-01-23
CL0P	Consumer Goods	United States	Claim only	2025-01-23
CL0P	IT Services and IT Consulting	Netherlands	Claim only	2025-01-23
CL0P	Warehousing and Storage	United States	Claim only	2025-01-23
CL0P	Transportation, Logistics, Supply Chain and Storage	United States	Claim only	2025-01-23
CL0P	Oil and Gas	United States	Claim only	2025-01-23
CL0P	Food and Beverage Manufacturing	United States	Claim only	2025-01-23
CL0P	Transportation, Logistics, Supply Chain and Storage	United States	Claim only	2025-01-23
CL0P	Food and Beverage Services	Canada	Claim only	2025-01-23
CL0P	Software Development	United States	Claim only	2025-01-23
CL0P	Food and Beverages	United States	Claim only	2025-01-23

News and research context

Recent articles from the same time window.

HellCat and Morpheus | Two Brands, One Payload as Ransomware Affiliates Drop Identical Code 2025-01-23

Related actor: Hellcat

Analysis of payloads suggest affiliates may be using a shared codebase or common builder to deploy attacks under different RaaS brand names. Within this period of accelerated a…

How a $54 Billion Company Handled a Ransomware Attack 2025-01-23

Related actor: Dunghill Leak

When Johnson Controls International Plc suffered a devastating ransomware attack in 2023, one lesson for Chief Executive Officer George Oliver was that management needs to be as t…

AWS Releases Best Security Practices To Mitigate Ransomware Attacks 2025-01-22

Related actor: Codefinger

Amazon Web Services (AWS) has announced a set of best practices aimed at helping customers protect their cloud environments against ransomware attacks and other unauthorized activ…

Govtech giant Conduent won't rule out cyberattack as outage drags on | TechCrunch 2025-01-22

Related actor: SAFEPAY

An ongoing “service interruption” at government contractor giant Conduent sparked outages across several U.S. states, leaving residents without access to some benefits and support…

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” – Sophos News 2025-01-22

Related actor: BlackBasta

Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware. Sophos X-Ops’ Man…

Hackerangriff auf Schul-IT in Speyer | Stadt Speyer 2025-01-21

Auf die schulinternen Server der allgemeinbildenden Schulen und der Berufsbildenden Schule in Speyer hat es in der vergangenen Woche einen Hackerangriff gegeben. Nach dem Hacke…

Edw. C. Levy Co. Announces Data Breach Following Ransomware Attack | Console and Associates, P.C. - JDSupra 2025-01-21

On January 16, 2025, Edw. C. Levy Co., also known as The Levy Group of Companies (“Levy”), filed a notice of data breach with the Attorney General of Maine after hackers deployed…

UAE Cyber Security Council announces successful countering of ransomware attacks, identification of hackers 2025-01-20

ABU DHABI, 17th January, 2025 (WAM) -- The UAE Cyber Security Council announced that the national cybersecurity systems successfully thwarted malicious ransomware attacks targetin…

Blacon High School forced to close after 'ransomware attack' - BBC News 2025-01-19

The school will be closed on 20 and 21 January while the data breach is investigated. A school in Cheshire has announced a temporary closure after falling victim to a "ransomware…

Datenschutzvorfall bei der D-Trust 2025-01-17

Berlin, 16.01.2025 - Die D-Trust GmbH ist Ziel eines Angriffs auf das Antragsportal für Signatur- und Siegelkarten geworden. Der Angriff wurde am 13.1.2025 festgestellt. Dabei sin…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.