Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2025-05-16 → 2025-05-22 UTC

Choose a report date

Observed events

124

Public claims in the selected week

Data leak indicators

75.8% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

SAFEPAY generated the highest visible claim volume this week, representing 16.9% of observed events.

•

75.8% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 12 observed events.

•

6 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

5 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

•

3 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.

Coverage snapshot

As of 2025-05-22 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

SAFEPAY

21 events · 21 leak indicators

Qilin

16 events · 10 leak indicators

Akira

11 events · 5 leak indicators

INC Ransom

11 events · 11 leak indicators

DATACARRY

7 events · 7 leak indicators

NightSpire

7 events · 7 leak indicators

Sarcoma

7 events · 7 leak indicators

Stormous

7 events · 4 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

DATACARRY 7 events
Arcus Media 5 events
World Leaks 3 events
Arkana 1 event
Data Leak 1 event
Morpheus 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States50

Qilin10 events · 8 leak indicators
SAFEPAY8 events · 8 leak indicators
Akira7 events · 4 leak indicators
INC Ransom5 events · 5 leak indicators
PLAY5 events · 5 leak indicators
Sarcoma5 events · 5 leak indicators
Kairos2 events · 2 leak indicators
Lynx2 events · 2 leak indicators

Germany12

SAFEPAY8 events · 8 leak indicators
INC Ransom3 events · 3 leak indicators
Akira1 event · 1 leak indicator

United Kingdom7

SAFEPAY2 events · 2 leak indicators
Arkana1 event · 0 leak indicators
DATACARRY1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
INTERLOCK1 event · 1 leak indicator
Stormous1 event · 1 leak indicator

Canada6

Qilin2 events · 1 leak indicator
Akira1 event · 0 leak indicators
Gunra1 event · 0 leak indicators
SAFEPAY1 event · 1 leak indicator
Sarcoma1 event · 1 leak indicator

France4

Qilin2 events · 1 leak indicator
Stormous1 event · 1 leak indicator
World Leaks1 event · 1 leak indicator

Spain4

Arcus Media2 events · 0 leak indicators
NightSpire2 events · 2 leak indicators

Austria2

DATACARRY1 event · 1 leak indicator
NightSpire1 event · 1 leak indicator

Belgium2

DATACARRY1 event · 1 leak indicator
World Leaks1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction12

SAFEPAY4 events · 4 leak indicators
Qilin3 events · 1 leak indicator
PLAY2 events · 2 leak indicators
BERT1 event · 0 leak indicators
RansomHouse1 event · 0 leak indicators
Sarcoma1 event · 1 leak indicator

Hospitality10

Stormous7 events · 4 leak indicators
Arcus Media1 event · 0 leak indicators
INC Ransom1 event · 1 leak indicator
NightSpire1 event · 1 leak indicator

IT Services and IT Consulting6

Akira2 events · 1 leak indicator
SAFEPAY2 events · 2 leak indicators
Arcus Media1 event · 0 leak indicators
PLAY1 event · 1 leak indicator

Real Estate6

Akira1 event · 0 leak indicators
INC Ransom1 event · 1 leak indicator
Morpheus1 event · 0 leak indicators
Qilin1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator
Sarcoma1 event · 1 leak indicator

Hospitals and Health Care5

Qilin2 events · 2 leak indicators
Rhysida1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator
Space Bears1 event · 0 leak indicators

Law Practice5

INC Ransom1 event · 1 leak indicator
Lynx1 event · 1 leak indicator
PLAY1 event · 1 leak indicator
Qilin1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Manufacturing4

IMN Crew1 event · 1 leak indicator
Lynx1 event · 1 leak indicator
Qilin1 event · 0 leak indicators
SAFEPAY1 event · 1 leak indicator

Retail4

DATACARRY2 events · 2 leak indicators
Akira1 event · 1 leak indicator
NightSpire1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

11-50 employees 45
51-200 employees 27
201-500 employees 14
1,001-5,000 employees 12
2-10 employees 7
501-1,000 employees 7

Notable actor profile updates

Active actor records only.

New ransom note observed

No ransom-note change logged in this reporting window.

New actor infrastructure / contact channel

No infrastructure/contact-channel change logged in this reporting window.

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
Qilin	Automotive	United States	Data leak	2025-05-22
NightSpire	Facilities Services	Spain	Data leak	2025-05-22
SAFEPAY	Education Management	United States	Data leak	2025-05-22
DATACARRY	Insurance	Latvia	Data leak	2025-05-22
DATACARRY	Financial Services	Malta	Data leak	2025-05-22
DATACARRY	Legal Services	Belgium	Data leak	2025-05-22
DATACARRY	Retail	South Africa	Data leak	2025-05-22
DATACARRY	Retail	Austria	Data leak	2025-05-22
DATACARRY	Wellness and Fitness Services	Denmark	Data leak	2025-05-22
DATACARRY	Airlines and Aviation	United Kingdom	Data leak	2025-05-22
Akira	Real Estate	United States	Claim only	2025-05-22
Akira	Legal Services	United States	Claim only	2025-05-22

News and research context

Recent articles from the same time window.

El Deportivo de La Coruña sufre un ciberataque: se han robado datos personales de abonados 2025-05-22

El club acaba de emitir un comunicado a los afectados explicando el hackeo. Se han robado datos identificativos y de contacto, por lo que recomiendan tomar precauciones. No se han…

Russian national suspected of creating Ragnar Locker ransomware insists he's innocent 2025-05-21

Related actor: RagnarLocker

Oleg B. was suspected of being one of the key developers of Ragnar Locker, ransomware used by the eponymous cybercriminal group, which has been under judicial investigation since…

3AM ransomware uses spoofed IT calls, email bombing to breach networks 2025-05-21

Related actor: 3AM

A 3AM ransomware affiliate is conducting highly targeted attacks using email bombing and spoofed IT support calls to socially engineer employees into giving credentials for remote…

Morgan County 911 Cyber attack leaves systems down for days 2025-05-21

Related actor: Qilin

Morgan County officials said that on Wednesday, May 14, Morgan County 911 a separate agency, experienced a cyber attack. Morgan County IT disconnected the data connection to Morga…

Ransomware attack triggers "system-wide" tech outage at large network of medical centers | CNN Politics 2025-05-21

Related actor: INTERLOCK

A ransomware attack has triggered a “system-wide technology outage” at a network of over a dozen medical centers in Ohio, causing the cancellation of elective inpatient and outpat…

Cellcom CEO confirms 'cyber incident' led to ongoing service outage 2025-05-21

Cellcom confirms a cyber incident caused the outage frustrating its customers for nearly a week. A letter from CEO Brighid Riordan assures customers they are working around the c…

VanHelsing ransomware builder leaked on hacking forum 2025-05-21

Related actor: VanHelsing

The VanHelsing ransomware-as-a-service operation published the source code for its affiliate panel, data leak blog, and Windows encryptor builder after an old developer tried to s…

UK supermarket distributor suffers ransomware attack 2025-05-20

A distributor to the UK's major supermarkets has said it is being held to ransom by cyber hackers. Logistics firm Peter Green Chilled supplies supermarkets including Tesco, Sai…

Notice of Data Incident | BRG 2025-05-19

Berkeley Research Group, LLC (“BRG” or “we”) is providing notice of an incident that may have affected protected health information and/or personally identifiable information stor…

Hacker had broad access to Eindhoven University's network for days in January | NL Times 2025-05-19

The hacker who was caught carrying out a cyber attack on the Eindhoven University of Technology (TU/e) in January had undetected and broad access to the university’s network for d…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.