Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-03-30 → 2026-04-05 UTC

Choose a report date

Observed events

236

Public claims in the selected week

Data leak indicators

157

66.5% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

Akira generated the highest visible claim volume this week, representing 9.7% of observed events.

•

66.5% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 12 observed events.

•

6 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

5 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2026-04-05 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

Akira

23 events · 8 leak indicators

DragonForce

23 events · 21 leak indicators

LockBit 5.0

20 events · 20 leak indicators

Qilin

17 events · 6 leak indicators

NightSpire

16 events · 11 leak indicators

Gentlemen

14 events · 1 leak indicator

INC Ransom

14 events · 11 leak indicators

ATTACKER

13 events · 11 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

ATTACKER 13 events
Krybit 4 events
BQTlock 1 event
Morpheus 1 event
Sarcoma 1 event
SECUROTROP 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States102

Akira21 events · 6 leak indicators
DragonForce10 events · 8 leak indicators
ATTACKER9 events · 8 leak indicators
INC Ransom8 events · 6 leak indicators
Qilin8 events · 2 leak indicators
Genesis7 events · 0 leak indicators
PLAY5 events · 5 leak indicators
Leaknet Blog4 events · 4 leak indicators

United Kingdom12

PLAY5 events · 5 leak indicators
DragonForce2 events · 2 leak indicators
BravoX1 event · 1 leak indicator
Coinbase Cartel1 event · 1 leak indicator
Genesis1 event · 0 leak indicators
Gentlemen1 event · 1 leak indicator
Qilin1 event · 1 leak indicator

Italy9

LockBit 5.06 events · 6 leak indicators
Gentlemen1 event · 0 leak indicators
INC Ransom1 event · 1 leak indicator
Qilin1 event · 1 leak indicator

Canada8

DragonForce3 events · 3 leak indicators
ATTACKER2 events · 2 leak indicators
Qilin2 events · 1 leak indicator
MNT61 event · 1 leak indicator

Germany8

Qilin2 events · 0 leak indicators
AiLock1 event · 1 leak indicator
Coinbase Cartel1 event · 0 leak indicators
DragonForce1 event · 1 leak indicator
INC Ransom1 event · 0 leak indicators
PLAY1 event · 1 leak indicator
World Leaks1 event · 1 leak indicator

France7

LockBit 5.02 events · 2 leak indicators
NightSpire2 events · 2 leak indicators
Akira1 event · 1 leak indicator
Coinbase Cartel1 event · 1 leak indicator
XP951 event · 0 leak indicators

Thailand5

Gentlemen4 events · 0 leak indicators
DragonForce1 event · 1 leak indicator

Brazil4

Gentlemen1 event · 0 leak indicators
Krybit1 event · 0 leak indicators
LockBit 5.01 event · 1 leak indicator
RALord1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction12

LockBit 5.03 events · 3 leak indicators
NightSpire2 events · 1 leak indicator
Qilin2 events · 1 leak indicator
Akira1 event · 0 leak indicators
ATTACKER1 event · 1 leak indicator
Coinbase Cartel1 event · 1 leak indicator
Everest1 event · 0 leak indicators
PLAY1 event · 1 leak indicator

Law Practice10

INC Ransom4 events · 3 leak indicators
LeakedData2 events · 2 leak indicators
PLAY2 events · 2 leak indicators
ATTACKER1 event · 1 leak indicator
SECUROTROP1 event · 1 leak indicator

Insurance9

Akira3 events · 0 leak indicators
DragonForce1 event · 0 leak indicators
Genesis1 event · 0 leak indicators
Gentlemen1 event · 0 leak indicators
Leaknet Blog1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator
PEAR1 event · 1 leak indicator

Manufacturing9

DragonForce3 events · 3 leak indicators
LockBit 5.03 events · 3 leak indicators
Akira2 events · 0 leak indicators
RALord1 event · 1 leak indicator

Industrial Machinery Manufacturing8

Akira1 event · 1 leak indicator
Crypto241 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
Genesis1 event · 0 leak indicators
LockBit 5.01 event · 1 leak indicator
PLAY1 event · 1 leak indicator
Qilin1 event · 1 leak indicator
World Leaks1 event · 1 leak indicator

IT Services and IT Consulting8

Qilin2 events · 0 leak indicators
Akira1 event · 1 leak indicator
ATTACKER1 event · 1 leak indicator
Coinbase Cartel1 event · 0 leak indicators
DragonForce1 event · 1 leak indicator
FulcrumSec1 event · 1 leak indicator
Gentlemen1 event · 1 leak indicator

Real Estate7

Akira1 event · 1 leak indicator
ATTACKER1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
INC Ransom1 event · 1 leak indicator
Leaknet Blog1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator
PLAY1 event · 1 leak indicator

Retail6

Gentlemen2 events · 0 leak indicators
Akira1 event · 0 leak indicators
DragonForce1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator
ShinyHunters1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

51-200 employees 62
11-50 employees 55
201-500 employees 26
501-1,000 employees 18
1,001-5,000 employees 13
2-10 employees 13

Notable actor profile updates

Active actor records only.

New ransom note observed

No ransom-note change logged in this reporting window.

New actor infrastructure / contact channel

NightSpire

2026-03-31 UTC

Adding new email addresses

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
MNT6	Renewable Energy Semiconductor Manufacturing	Canada	Data leak	2026-04-05
XP95	Software Development	France	Claim only	2026-04-05
RALord	Government Administration	Indonesia	Data leak	2026-04-05
Gentlemen	IT Services and IT Consulting	United Kingdom	Data leak	2026-04-05
DragonForce	Manufacturing	Canada	Data leak	2026-04-05
LockBit 5.0	Real Estate	Italy	Data leak	2026-04-05
PLAY	Wine and Spirits	United States	Data leak	2026-04-04
PLAY	Law Practice	United Kingdom	Data leak	2026-04-04
DragonForce	Manufacturing	Vietnam	Data leak	2026-04-04
DragonForce	Pharmaceutical Manufacturing	Egypt	Data leak	2026-04-04
DragonForce	Wholesale	United Kingdom	Data leak	2026-04-04
RALord	Electrical Equipment Manufacturing	United States	Data leak	2026-04-04

News and research context

Recent articles from the same time window.

St. Joseph County officials address cyber attack by Iranian-backed hacker group 2026-04-04

Related actor: Handala

St. Joseph County officials acknowledged a cyber attack by an Iranian-backed hacker group called Handala earlier this week. County officials and council members held a news con…

Omax Autos Confirms Ransomware Attack, Operations Remain Unaffected | Whalesbook Corporate News 2026-04-04

Omax Autos Limited has confirmed a ransomware attack on its IT infrastructure, first detected on March 26, 2026. The company stated that while IT systems were affected, its core o…

C2K: School IT system targeted in a cyber attack ahead of exam season 2026-04-04

An IT system used by schools across Northern Ireland has been targeted in a cyber attack, the Education Authority (EA) has said. On Thursday, schools received a message that as…

Italy's Uffizi Galleries targeted in cyber-attack but denies security breach 2026-04-04

The Uffizi Galleries in Florence have confirmed they were subject to a cyber-attack - but denied that the security systems protecting their famous works had been compromised. T…

Hackers hit Minot water treatment plant server in ransomware case, FBI investigating 2026-04-02

MINOT, ND (KXNET) — Hackers got into the Minot water treatment plant computer system earlier this month, but city officials stressed the water stayed safe and the plant never stop…

Yurei Double Extortion Ransomware: Operator Toolkit and Analysis 2026-04-01

Related actor: Yurei

Active since September 2025, Yurei is a double extortion ransomware campaign. The operators run their own Tor data leak site with a low number of victims listed at the time of wri…

HASBRO, INC. Cybersecurity Incident Details - Board Cybersecurity 2026-04-01

On March 28, 2026, Hasbro, Inc. (the "Company") identified unauthorized access to the Company's network. Upon discovery, the Company promptly activated its security incident respo…

Generalstaatsanwaltschaft Karlsruhe - PM vom 30.03.2026 2026-04-01

Related actor: REvil

Weiterer Erfolg im Kampf gegen die organisierte Cyberkriminalität: Mutmaßlicher Kopf und mutmaßlicher Programmierer der Ransomware-Gruppen „GandCrab“ und „REvil“ identifiziert – w…

Patient data potentially disclosed in Nacogdoches Memorial Hospital cyber-attack | cbs19.tv 2026-04-01

NACOGDOCHES, Texas — A security breach may have disclosed medical information of patients with Nacogdoches Memorial Hospital (NMH). According to NMH, the system became aware of…

Cota Reports System Disruption After Cyberattack, Probes Data Risk 2026-03-31

Cota Co., Ltd., a TSE Prime Market–listed company based in Kyoto Prefecture and active in the consumer and cosmetics-related field, reported a significant disruption to its intern…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.