Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-02-04 → 2026-02-10 UTC
Choose a report date
Previous week Next week
Observed events
211
Public claims in the selected week
Data leak indicators
148
70.1% of observed events
Active actors
36
Distinct groups with observed activity
Torrent-linked events
8
Events intersecting with torrent intelligence

What changed this week?

•
CL0P generated the highest visible claim volume this week, representing 16.6% of observed events.
•
70.1% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 13 observed events.
•
4 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
8 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2026-02-10 UTC.
Leak sites observed this week
36
Leak sites online near report date
0
Threat actor profiles updated this week
8
Countries represented this week
38
Sectors represented this week
81

Top active actors

By observed claim volume
CL0P
35 events · 35 leak indicators
Qilin
33 events · 23 leak indicators
Gentlemen
29 events · 1 leak indicator
Insomnia
17 events · 17 leak indicators
Akira
11 events · 4 leak indicators
PLAY
11 events · 10 leak indicators
Sinobi
10 events · 9 leak indicators
LockBit 5.0
7 events · 7 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days
  • Insomnia 17 events
  • Space Bears 3 events
  • LeakedData 1 event
  • Reynolds 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States111
  • CL0P24 events · 24 leak indicators
  • Qilin17 events · 14 leak indicators
  • Insomnia15 events · 15 leak indicators
  • PLAY10 events · 9 leak indicators
  • Sinobi7 events · 6 leak indicators
  • Akira6 events · 2 leak indicators
  • Payouts King4 events · 3 leak indicators
  • Anubis3 events · 0 leak indicators
Canada10
  • CL0P3 events · 3 leak indicators
  • Qilin2 events · 2 leak indicators
  • Sinobi2 events · 2 leak indicators
  • BravoX1 event · 1 leak indicator
  • DragonForce1 event · 1 leak indicator
  • SAFEPAY1 event · 1 leak indicator
United Kingdom7
  • Akira2 events · 0 leak indicators
  • CL0P2 events · 2 leak indicators
  • Anubis1 event · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • Qilin1 event · 0 leak indicators
France6
  • Gentlemen2 events · 0 leak indicators
  • BravoX1 event · 1 leak indicator
  • CL0P1 event · 1 leak indicator
  • Qilin1 event · 0 leak indicators
  • Sinobi1 event · 1 leak indicator
Brazil5
  • Gentlemen3 events · 0 leak indicators
  • Beast1 event · 0 leak indicators
  • Insomnia1 event · 1 leak indicator
Germany4
  • Qilin2 events · 2 leak indicators
  • Akira1 event · 0 leak indicators
  • PLAY1 event · 1 leak indicator
Italy4
  • CL0P1 event · 1 leak indicator
  • Gentlemen1 event · 0 leak indicators
  • Payouts King1 event · 1 leak indicator
  • Qilin1 event · 1 leak indicator
Japan4
  • BlackShrantac1 event · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • INC Ransom1 event · 0 leak indicators
  • Qilin1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction13
  • DragonForce3 events · 3 leak indicators
  • Gentlemen3 events · 0 leak indicators
  • CL0P2 events · 2 leak indicators
  • Sinobi2 events · 2 leak indicators
  • Akira1 event · 0 leak indicators
  • PLAY1 event · 1 leak indicator
  • SAFEPAY1 event · 1 leak indicator
IT Services and IT Consulting13
  • CL0P5 events · 5 leak indicators
  • Qilin2 events · 1 leak indicator
  • Akira1 event · 0 leak indicators
  • Anubis1 event · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • RALord1 event · 1 leak indicator
  • Sinobi1 event · 1 leak indicator
  • Tengu1 event · 1 leak indicator
Hospitals and Health Care11
  • Insomnia5 events · 5 leak indicators
  • CL0P2 events · 2 leak indicators
  • Qilin2 events · 1 leak indicator
  • Beast1 event · 0 leak indicators
  • World Leaks1 event · 1 leak indicator
Financial Services9
  • CL0P3 events · 3 leak indicators
  • Qilin2 events · 1 leak indicator
  • Gentlemen1 event · 0 leak indicators
  • Kill Security1 event · 1 leak indicator
  • LeakedData1 event · 1 leak indicator
  • Sinobi1 event · 1 leak indicator
Real Estate9
  • CL0P3 events · 3 leak indicators
  • PLAY2 events · 2 leak indicators
  • Anubis1 event · 0 leak indicators
  • Kill Security1 event · 1 leak indicator
  • Qilin1 event · 1 leak indicator
  • RALord1 event · 1 leak indicator
Law Practice7
  • Insomnia2 events · 2 leak indicators
  • Akira1 event · 1 leak indicator
  • Anubis1 event · 0 leak indicators
  • BravoX1 event · 1 leak indicator
  • CL0P1 event · 1 leak indicator
  • Qilin1 event · 1 leak indicator
Government Administration5
  • Qilin2 events · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • Green Blood1 event · 0 leak indicators
  • Tengu1 event · 1 leak indicator
Higher Education5
  • Gentlemen2 events · 0 leak indicators
  • ShinyHunters2 events · 2 leak indicators
  • Qilin1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.
  • 11-50 employees 58
  • 51-200 employees 53
  • 201-500 employees 30
  • 2-10 employees 22
  • 1,001-5,000 employees 19
  • 501-1,000 employees 6

Notable actor profile updates

Active actor records only.
New ransom note observed
Reynolds
2026-02-10 UTC
Adding ransom note
New actor infrastructure / contact channel
CiphBit
2026-02-10 UTC
Adding TOX ID
New vuln / TTP intelligence
Warlock
2026-02-09 UTC
Adding CVE-2026-24423

Recent signal samples

Selected weekly signals.
Actor Sector Country Leak proof Seen
Leaknet Blog Primary and Secondary Education United States Data leak 2026-02-10
Sinobi Paper and Forest Product Manufacturing Canada Data leak 2026-02-10
CL0P Financial Services United States Data leak 2026-02-10
CL0P Facilities Services United States Data leak 2026-02-10
CL0P Education Administration Programs United States Data leak 2026-02-10
BravoX Advertising Services United States Data leak 2026-02-10
Sinobi Information Technology and Services United States Claim only 2026-02-10
Sinobi Retail United States Data leak 2026-02-10
Sinobi Defense and Space Manufacturing United States Data leak 2026-02-10
PLAY Machinery Manufacturing United States Data leak 2026-02-10
CL0P Business Consulting and Services United States Data leak 2026-02-10
CL0P Civic and Social Organizations France Data leak 2026-02-10

News and research context

Recent articles from the same time window.
Ardene restoring services after 'cyber incident' 2026-02-10
Related actor: Akira
Canadian fashion retailer Ardene says it is dealing with a “cyber incident.” In an email sent to customers on Feb. 9, the Montreal-based company apologized for recent shipping…
Summary of SmarterTools Breach and SmarterMail CVEs 2026-02-09
Related actor: Warlock
As promised, we wanted to provide additional information regarding the network breach we experienced last Thursday (January 29, 2026), along with summaries of our releases and wha…
Impostor ransomware actor 0APT triggers panic 2026-02-05
Related actor: 0APT
A new actor called 0APT is causing a stir after they launched a dark web leak site and posted a large number of major companies, both genuine and fake, triggering real incident re…

Notes

  • Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
  • Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
  • Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
  • The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

  • The page uses a fixed seven-day window based on the selected date.
  • Only public-facing actor and event records are included.
  • Counts and breakdowns are designed for trend review, not incident confirmation.