Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-02-05 → 2026-02-11 UTC
Choose a report date
Previous week Next week
Observed events
222
Public claims in the selected week
Data leak indicators
163
73.4% of observed events
Active actors
35
Distinct groups with observed activity
Torrent-linked events
8
Events intersecting with torrent intelligence

What changed this week?

•
CL0P generated the highest visible claim volume this week, representing 15.8% of observed events.
•
73.4% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 15 observed events.
•
6 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
8 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.
•
1 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.

Coverage snapshot

As of 2026-02-11 UTC.
Leak sites observed this week
35
Leak sites online near report date
1
Threat actor profiles updated this week
7
Countries represented this week
38
Sectors represented this week
81

Top active actors

By observed claim volume
CL0P
35 events · 35 leak indicators
Qilin
35 events · 25 leak indicators
Gentlemen
33 events · 1 leak indicator
Insomnia
18 events · 18 leak indicators
PLAY
12 events · 12 leak indicators
Sinobi
11 events · 10 leak indicators
LockBit 5.0
8 events · 7 leak indicators
DragonForce
7 events · 7 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days
  • Insomnia 18 events
  • Meduza Locker 6 events
  • LeakedData 2 events
  • Gunra 1 event
  • Reynolds 1 event
  • SecP0 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States122
  • CL0P24 events · 24 leak indicators
  • Qilin24 events · 18 leak indicators
  • Insomnia16 events · 16 leak indicators
  • PLAY10 events · 10 leak indicators
  • Sinobi8 events · 7 leak indicators
  • DragonForce5 events · 5 leak indicators
  • INC Ransom4 events · 3 leak indicators
  • Payouts King4 events · 3 leak indicators
Canada13
  • CL0P3 events · 3 leak indicators
  • Meduza Locker2 events · 2 leak indicators
  • Qilin2 events · 2 leak indicators
  • Sinobi2 events · 2 leak indicators
  • BravoX1 event · 1 leak indicator
  • DragonForce1 event · 1 leak indicator
  • PLAY1 event · 1 leak indicator
  • SAFEPAY1 event · 1 leak indicator
France6
  • Gentlemen2 events · 0 leak indicators
  • BravoX1 event · 1 leak indicator
  • CL0P1 event · 1 leak indicator
  • Qilin1 event · 0 leak indicators
  • Sinobi1 event · 1 leak indicator
United Kingdom6
  • Akira2 events · 0 leak indicators
  • CL0P2 events · 2 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • Qilin1 event · 0 leak indicators
Brazil5
  • Gentlemen3 events · 0 leak indicators
  • Beast1 event · 1 leak indicator
  • Insomnia1 event · 1 leak indicator
Italy4
  • CL0P1 event · 1 leak indicator
  • Gentlemen1 event · 0 leak indicators
  • Payouts King1 event · 1 leak indicator
  • Qilin1 event · 1 leak indicator
Japan4
  • BlackShrantac1 event · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • INC Ransom1 event · 0 leak indicators
  • Qilin1 event · 1 leak indicator
Mexico4
  • Payouts King1 event · 1 leak indicator
  • Qilin1 event · 0 leak indicators
  • Tengu1 event · 1 leak indicator
  • World Leaks1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction15
  • DragonForce5 events · 5 leak indicators
  • Gentlemen4 events · 0 leak indicators
  • CL0P2 events · 2 leak indicators
  • Sinobi2 events · 2 leak indicators
  • PLAY1 event · 1 leak indicator
  • SAFEPAY1 event · 1 leak indicator
Hospitals and Health Care11
  • Insomnia5 events · 5 leak indicators
  • CL0P2 events · 2 leak indicators
  • Qilin2 events · 1 leak indicator
  • Beast1 event · 1 leak indicator
  • World Leaks1 event · 1 leak indicator
Legal Services11
  • CL0P3 events · 3 leak indicators
  • Qilin3 events · 1 leak indicator
  • Beast2 events · 2 leak indicators
  • Insomnia2 events · 2 leak indicators
  • SecP01 event · 1 leak indicator
IT Services and IT Consulting10
  • CL0P5 events · 5 leak indicators
  • Akira1 event · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • Qilin1 event · 1 leak indicator
  • RALord1 event · 1 leak indicator
  • Sinobi1 event · 1 leak indicator
Financial Services9
  • CL0P3 events · 3 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • Gunra1 event · 1 leak indicator
  • Kill Security1 event · 1 leak indicator
  • LeakedData1 event · 1 leak indicator
  • Qilin1 event · 0 leak indicators
  • Sinobi1 event · 1 leak indicator
Real Estate8
  • CL0P3 events · 3 leak indicators
  • PLAY2 events · 2 leak indicators
  • Anubis1 event · 0 leak indicators
  • Qilin1 event · 1 leak indicator
  • RALord1 event · 1 leak indicator
Law Practice6
  • Insomnia2 events · 2 leak indicators
  • Akira1 event · 1 leak indicator
  • Anubis1 event · 0 leak indicators
  • BravoX1 event · 1 leak indicator
  • CL0P1 event · 1 leak indicator
Retail6
  • Gentlemen2 events · 0 leak indicators
  • Qilin2 events · 2 leak indicators
  • SAFEPAY1 event · 1 leak indicator
  • Sinobi1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.
  • 11-50 employees 61
  • 51-200 employees 54
  • 201-500 employees 30
  • 2-10 employees 28
  • 1,001-5,000 employees 19
  • 501-1,000 employees 7

Notable actor profile updates

Active actor records only.
New ransom note observed
razr
2026-02-11 UTC
Adding new ransom note, adding new email address, adding new sample on Any Run
New actor infrastructure / contact channel
BlackField
2026-02-11 UTC
Adding new email addresses
New vuln / TTP intelligence
Warlock
2026-02-09 UTC
Adding CVE-2026-24423

Recent signal samples

Selected weekly signals.
Actor Sector Country Leak proof Seen
SecP0 Legal Services United States Data leak 2026-02-11
Gentlemen Packaging and Containers Manufacturing United States Claim only 2026-02-11
Gentlemen Government Administration Ghana Claim only 2026-02-11
Gentlemen Education Thailand Claim only 2026-02-11
Gentlemen Investment Management Turkey Claim only 2026-02-11
Gentlemen Construction Malaysia Claim only 2026-02-11
DragonForce Construction United States Data leak 2026-02-11
Beast Legal Services United States Data leak 2026-02-11
Beast Legal Services United States Data leak 2026-02-11
INC Ransom Architecture and Planning United States Data leak 2026-02-11
DragonForce Construction United States Data leak 2026-02-11
PLAY Accounting United States Data leak 2026-02-11

News and research context

Recent articles from the same time window.
Ardene restoring services after 'cyber incident' 2026-02-10
Related actor: Akira
Canadian fashion retailer Ardene says it is dealing with a “cyber incident.” In an email sent to customers on Feb. 9, the Montreal-based company apologized for recent shipping…
Summary of SmarterTools Breach and SmarterMail CVEs 2026-02-09
Related actor: Warlock
As promised, we wanted to provide additional information regarding the network breach we experienced last Thursday (January 29, 2026), along with summaries of our releases and wha…
Impostor ransomware actor 0APT triggers panic 2026-02-05
Related actor: 0APT
A new actor called 0APT is causing a stir after they launched a dark web leak site and posted a large number of major companies, both genuine and fake, triggering real incident re…

Notes

  • Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
  • Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
  • Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
  • The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

  • The page uses a fixed seven-day window based on the selected date.
  • Only public-facing actor and event records are included.
  • Counts and breakdowns are designed for trend review, not incident confirmation.