Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-02-25 → 2026-03-03 UTC

Choose a report date

Observed events

238

Public claims in the selected week

Data leak indicators

148

62.2% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

Qilin generated the highest visible claim volume this week, representing 19.3% of observed events.

•

62.2% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 16 observed events.

•

7 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

4 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

•

4 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.

Coverage snapshot

As of 2026-03-03 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

Qilin

46 events · 24 leak indicators

Vect

21 events · 6 leak indicators

Gentlemen

20 events · 0 leak indicators

INC Ransom

20 events · 18 leak indicators

AiLock

18 events · 16 leak indicators

PLAY

14 events · 14 leak indicators

NightSpire

12 events · 1 leak indicator

DragonForce

9 events · 9 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

Vect 21 events
AiLock 18 events
Blackout 1 event
KITTYKATKREW 1 event
Metaencryptor 1 event
MyData 1 event
XP95 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States117

Qilin24 events · 14 leak indicators
AiLock14 events · 13 leak indicators
INC Ransom13 events · 11 leak indicators
PLAY12 events · 12 leak indicators
NightSpire7 events · 0 leak indicators
Akira5 events · 4 leak indicators
DragonForce5 events · 5 leak indicators
Medusa5 events · 5 leak indicators

Germany10

Qilin2 events · 1 leak indicator
AiLock1 event · 0 leak indicators
Gunra1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
Lynx1 event · 1 leak indicator
Medusa1 event · 1 leak indicator
Metaencryptor1 event · 1 leak indicator
PLAY1 event · 1 leak indicator

Brazil9

Vect4 events · 2 leak indicators
Gentlemen2 events · 0 leak indicators
DragonForce1 event · 1 leak indicator
Gunra1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator

France8

Qilin5 events · 3 leak indicators
DragonForce1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
NightSpire1 event · 0 leak indicators

Canada6

Gentlemen2 events · 0 leak indicators
Akira1 event · 0 leak indicators
INC Ransom1 event · 1 leak indicator
PLAY1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Italy6

Qilin2 events · 0 leak indicators
NightSpire1 event · 0 leak indicators
Payload1 event · 1 leak indicator
Tengu1 event · 1 leak indicator
Vect1 event · 0 leak indicators

Spain6

Gunra2 events · 2 leak indicators
Gentlemen1 event · 0 leak indicators
RansomHouse1 event · 0 leak indicators
Vect1 event · 0 leak indicators
XP951 event · 0 leak indicators

India5

Vect4 events · 1 leak indicator
Gentlemen1 event · 0 leak indicators

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction16

PLAY4 events · 4 leak indicators
DragonForce3 events · 3 leak indicators
INC Ransom2 events · 2 leak indicators
Insomnia1 event · 1 leak indicator
Medusa1 event · 1 leak indicator
NightSpire1 event · 0 leak indicators
Payload1 event · 1 leak indicator
Qilin1 event · 0 leak indicators

Law Practice15

INC Ransom6 events · 6 leak indicators
PEAR2 events · 2 leak indicators
PLAY2 events · 2 leak indicators
AiLock1 event · 0 leak indicators
Anubis1 event · 0 leak indicators
Kairos1 event · 1 leak indicator
Qilin1 event · 1 leak indicator
Termite1 event · 0 leak indicators

IT Services and IT Consulting11

Vect2 events · 0 leak indicators
AiLock1 event · 0 leak indicators
BravoX1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
Linkc1 event · 0 leak indicators
NightSpire1 event · 0 leak indicators
PLAY1 event · 1 leak indicator

Motor Vehicle Manufacturing8

Qilin5 events · 3 leak indicators
Everest1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
Morpheus1 event · 0 leak indicators

Financial Services7

LeakedData2 events · 2 leak indicators
AiLock1 event · 1 leak indicator
Insomnia1 event · 1 leak indicator
KITTYKATKREW1 event · 0 leak indicators
ShinyHunters1 event · 1 leak indicator
Vect1 event · 1 leak indicator

Real Estate6

Vect2 events · 1 leak indicator
Gentlemen1 event · 0 leak indicators
Gunra1 event · 1 leak indicator
PLAY1 event · 1 leak indicator
RansomHouse1 event · 0 leak indicators

Software Development6

Vect2 events · 1 leak indicator
Akira1 event · 1 leak indicator
NightSpire1 event · 0 leak indicators
ShinyHunters1 event · 1 leak indicator
XP951 event · 0 leak indicators

Transportation, Logistics, Supply Chain and Storage6

DragonForce2 events · 2 leak indicators
Qilin2 events · 1 leak indicator
INC Ransom1 event · 1 leak indicator
Lynx1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

51-200 employees 64
11-50 employees 63
2-10 employees 29
201-500 employees 20
501-1,000 employees 19
1,001-5,000 employees 13

Notable actor profile updates

Active actor records only.

New ransom note observed

No ransom-note change logged in this reporting window.

New actor infrastructure / contact channel

No infrastructure/contact-channel change logged in this reporting window.

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
Gunra	Real Estate	Germany	Data leak	2026-03-03
Vect	Renewable Energy Power Generation	Peru	Claim only	2026-03-03
INC Ransom	Law Practice	United States	Data leak	2026-03-03
INC Ransom	Law Practice	United States	Data leak	2026-03-03
Metaencryptor	Pharmaceutical Manufacturing	Germany	Data leak	2026-03-03
INC Ransom	Law Practice	United States	Data leak	2026-03-03
INC Ransom	Law Practice	United States	Data leak	2026-03-03
DragonForce	Construction	United States	Data leak	2026-03-03
DragonForce	Newspaper Publishing	United States	Data leak	2026-03-03
Qilin	Construction	France	Claim only	2026-03-03
Qilin	Wholesale	France	Data leak	2026-03-03
SAFEPAY	Paper and Forest Product Manufacturing	Canada	Data leak	2026-03-03

News and research context

Recent articles from the same time window.

Ransomware Tightens Grip on CA & Consulting Firms; NAS Devices Emerge as Prime Target - The420.in 2026-03-03

Chartered Accountancy (CA) firms and consulting organizations across India are witnessing a sharp rise in ransomware attacks, with threat actors increasingly targeting Network Att…

Court blocks HSB's ransomware sub-limit in first-of-its-kind cyber ruling | Insurance Business 2026-03-03

A federal court has sent a clear message to cyber insurers: when an endorsement does not say what it means, courts will not fill in the gaps on the insurer's behalf. In a rulin…

Brit games studio Cloud Imperium admits to data breach • The Register 2026-03-03

On 21 January 2026, CIG was targeted by a systematic and sophisticated attack, resulting in unauthorised access to some backup systems, including limited access to users’ personal…

VulnCheck finds ransomware operators increasingly relying on zero-days, raising risk in OT environments - Industrial Cyber 2026-02-27

In its ‘The 2026 VulnCheck: Exploit Intelligence Report,’ VulnCheck identified 50 routinely targeted vulnerabilities that carried elevated risk by year’s end, while proof-of-conce…

[Op Report] Velvet Tempest linked to ClickFix campaigns for Termite Ransomware, HoK Activity Observed 2026-02-27

Related actor: Termite

During a 12-day Deception.Pro operation, researchers observed a high-severity, multi-stage intrusion chain that began with malvertising and a ClickFix-style fake CAPTCHA. The lure…

Notice of Data Breach - TriZetto Provider Solutions 2026-02-26

TriZetto Provider Solutions (“TPS”) recently experienced a cybersecurity incident that affected certain protected health information of certain of its healthcare provider customer…

The Post-RAMP Era: Allegations, Fragmentation, and the Rebuilding of the Ransomware Underground 2026-02-26

The January 2026 seizure of RAMP disrupted a major ransomware coordination hub, but it did not dismantle the ecosystem behind it. Instead, it destabilized trust and accelerated fr…

Crypto Ransomware: 2026 Crypto Crime Report 2026-02-26

Ransomware payments stagnated despite record attacks claimed. Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%…

230,000 Australian driver licences exposed in ransomware attack on vehicle finance firm | CarExpert 2026-02-25

Related actor: FulcrumSec

Approximately 229,226 Australian driver licences have reportedly been exposed by hackers who breached security at YouX, a popular software platform used by automakers and dealers…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.