Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2025-10-04 → 2025-10-10 UTC

Choose a report date

Observed events

168

Public claims in the selected week

Data leak indicators

133

79.2% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

Qilin generated the highest visible claim volume this week, representing 18.5% of observed events.

•

79.2% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 11 observed events.

•

5 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

15 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

•

4 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.

Coverage snapshot

As of 2025-10-10 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

Qilin

31 events · 27 leak indicators

Sinobi

25 events · 24 leak indicators

Akira

20 events · 17 leak indicators

INC Ransom

11 events · 9 leak indicators

BrotherHood

8 events · 6 leak indicators

SAFEPAY

8 events · 8 leak indicators

Chaos

5 events · 5 leak indicators

DragonForce

5 events · 5 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

BrotherHood 8 events
Kryptos 3 events
CL0P 1 event
INTERLOCK 1 event
Payouts King 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States97

Sinobi20 events · 19 leak indicators
Qilin19 events · 17 leak indicators
Akira16 events · 13 leak indicators
INC Ransom6 events · 6 leak indicators
Chaos5 events · 5 leak indicators
PLAY4 events · 4 leak indicators
BrotherHood3 events · 3 leak indicators
SAFEPAY3 events · 3 leak indicators

Canada10

Akira2 events · 2 leak indicators
INC Ransom2 events · 1 leak indicator
SAFEPAY2 events · 2 leak indicators
BrotherHood1 event · 1 leak indicator
Kryptos1 event · 0 leak indicators
Rhysida1 event · 1 leak indicator
SECUROTROP1 event · 1 leak indicator

Australia5

BrotherHood1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
Kryptos1 event · 0 leak indicators
Scattered LAPSUS$ Hunters1 event · 0 leak indicators

Germany5

Qilin2 events · 2 leak indicators
DragonForce1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator
World Leaks1 event · 1 leak indicator

Spain4

Space Bears2 events · 2 leak indicators
DragonForce1 event · 1 leak indicator
Qilin1 event · 0 leak indicators

France3

Qilin2 events · 2 leak indicators
Sinobi1 event · 1 leak indicator

United Kingdom3

Akira1 event · 1 leak indicator
BrotherHood1 event · 0 leak indicators
Radiant1 event · 0 leak indicators

Argentina2

Beast1 event · 0 leak indicators
SAFEPAY1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction11

Akira4 events · 4 leak indicators
INC Ransom2 events · 2 leak indicators
PLAY2 events · 2 leak indicators
Sinobi2 events · 2 leak indicators
Chaos1 event · 1 leak indicator

Financial Services7

Qilin2 events · 2 leak indicators
Scattered LAPSUS$ Hunters2 events · 0 leak indicators
Akira1 event · 1 leak indicator
Medusa1 event · 1 leak indicator
Sinobi1 event · 1 leak indicator

Law Practice7

Akira3 events · 3 leak indicators
Qilin2 events · 2 leak indicators
SAFEPAY1 event · 1 leak indicator
Sinobi1 event · 1 leak indicator

Wholesale7

Qilin2 events · 1 leak indicator
Sinobi2 events · 2 leak indicators
Akira1 event · 0 leak indicators
BrotherHood1 event · 1 leak indicator
Sarcoma1 event · 1 leak indicator

Hospitals and Health Care6

Sinobi2 events · 2 leak indicators
World Leaks2 events · 2 leak indicators
PEAR1 event · 1 leak indicator
Rhysida1 event · 1 leak indicator

Transportation, Logistics, Supply Chain and Storage6

Gentlemen2 events · 0 leak indicators
Anubis1 event · 0 leak indicators
BrotherHood1 event · 1 leak indicator
Qilin1 event · 1 leak indicator
Space Bears1 event · 1 leak indicator

Software Development5

BrotherHood3 events · 2 leak indicators
Akira1 event · 1 leak indicator
Scattered LAPSUS$ Hunters1 event · 0 leak indicators

Appliances, Electrical, and Electronics Manufacturing4

Beast1 event · 0 leak indicators
BlackShrantac1 event · 0 leak indicators
PLAY1 event · 1 leak indicator
Qilin1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

51-200 employees 45
11-50 employees 41
201-500 employees 20
1,001-5,000 employees 14
2-10 employees 13
501-1,000 employees 12

Notable actor profile updates

Active actor records only.

New ransom note observed

No ransom-note change logged in this reporting window.

New actor infrastructure / contact channel

No infrastructure/contact-channel change logged in this reporting window.

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
Kairos	Maritime Transportation	Cyprus	Claim only	2025-10-10
Devman	Environmental Services	Jamaica	Data leak	2025-10-10
Sinobi	Museums, Historical Sites, and Zoos	United States	Data leak	2025-10-10
DragonForce	Retail	Australia	Data leak	2025-10-10
Sinobi	Manufacturing	Saudi Arabia	Data leak	2025-10-10
Sinobi	Health, Wellness and Fitness	United States	Data leak	2025-10-10
CL0P	Higher Education	United States	Data leak	2025-10-10
SAFEPAY	Machinery Manufacturing	Canada	Data leak	2025-10-10
SAFEPAY	Accounting	Canada	Data leak	2025-10-10
SAFEPAY	Individual and Family Services	United States	Data leak	2025-10-10
SAFEPAY	Law Practice	United States	Data leak	2025-10-10
PEAR	Medical Practice	United States	Data leak	2025-10-10

News and research context

Recent articles from the same time window.

Paying off cyber criminals no guarantee stolen data won't be published - study - TechCentral.ie 2025-10-10

Almost three-quarters (70%) of Irish business who have experienced a ransomware attack paid a ransom in the past 12 months to prevent sensitive data being published, however, near…

Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign | Google Cloud Blog 2025-10-09

Related actor: CL0P

Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the…

Velociraptor leveraged in ransomware attacks 2025-10-09

Related actor: Warlock

In August 2025, Talos responded to a ransomware attack by actors who appeared to be affiliated with Warlock ransomware, based on their ransom note and use of Warlock’s data leak s…

Landmark $5.8m penalty over health data cyber attack | The Canberra Times | Canberra, ACT 2025-10-09

Related actor: Quantum

Medlab Pathology was hit with a cyber attack and ransomware demand by a malicious actor known as the Quantum Group in February 2022. About 86 gigabytes of data was taken and publ…

The Evolution of Chaos Ransomware: Faster, Smarter, and More Dangerous | FortiGuard Labs 2025-10-08

Related actor: Chaos

In 2025, Chaos ransomware resurfaced with a C++ variant. We believe this marks the first time it was not written in .NET. Beyond encryption and ransom demands, it adds destructive…

Wichtige Information - SAACKE Group 2025-10-08

Related actor: Lynx

Am 30.09.2025 wurde unsere IT-Infrastruktur Ziel eines Hackerangriffs. Wir haben sofort reagiert, betroffene Systeme isoliert und zusätzliche Sicherheitsmaßnahmen eingeleitet. Gem…

Crimson Collective: A New Threat Group Observed Operating in the Cloud | Rapid7 Labs 2025-10-08

Related actor: Crimson Collective

Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments, Crimson Collective, who recently claimed to have stolen private repositories from Re…

Two arrested over nursery cyber-attack 2025-10-07

Related actor: Radiant

Two men have been arrested by police investigating reports of a cyber-attack on a chain of London-based nurseries. The Met Police say the pair, aged 17 and 22, were arrested in…

The Ransomware Pricing Paradox: An Empirical Study of the Six Stages of Ransomware Negotiations 2025-10-07

Ransomware has become the most common cyber risk for businesses. The rise is not driven by attackers using innovative attacks, but instead by deteriorating negotiation outcomes. T…

Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability | Microsoft Security Blog 2025-10-06

Related actor: Medusa

On September 18, 2025, Fortra published a security advisory regarding a critical deserialization vulnerability in GoAnywhere MFT’s License Servlet, which is tracked as CVE-2025-10…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.