Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-04-23 → 2026-04-29 UTC
Choose a report date
Previous week Next week
Observed events
184
Public claims in the selected week
Data leak indicators
111
60.3% of observed events
Active actors
36
Distinct groups with observed activity
Torrent-linked events
1
Events intersecting with torrent intelligence

What changed this week?

•
Qilin generated the highest visible claim volume this week, representing 24.5% of observed events.
•
60.3% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 11 observed events.
•
8 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
•
1 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

Coverage snapshot

As of 2026-04-29 UTC.
Leak sites observed this week
36
Leak sites online near report date
0
Threat actor profiles updated this week
4
Countries represented this week
38
Sectors represented this week
72

Top active actors

By observed claim volume
Qilin
45 events · 22 leak indicators
Gentlemen
14 events · 0 leak indicators
DragonForce
13 events · 13 leak indicators
INC Ransom
13 events · 12 leak indicators
Eraleignews
9 events · 9 leak indicators
LeakedData
9 events · 4 leak indicators
M3rx
8 events · 0 leak indicators
Aur0ra
7 events · 7 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days
  • M3rx 8 events
  • Aur0ra 7 events
  • CL0P 1 event
  • Meduza Locker 1 event
  • RADAR 1 event
  • Rhysida 1 event
  • SecP0 1 event
  • Trident 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States75
  • Qilin18 events · 8 leak indicators
  • DragonForce10 events · 10 leak indicators
  • INC Ransom9 events · 9 leak indicators
  • Aur0ra5 events · 5 leak indicators
  • Payouts King5 events · 4 leak indicators
  • ShinyHunters3 events · 3 leak indicators
  • Akira2 events · 2 leak indicators
  • Insomnia2 events · 2 leak indicators
United Kingdom8
  • Qilin4 events · 1 leak indicator
  • M3rx2 events · 0 leak indicators
  • Brain Cipher1 event · 1 leak indicator
  • Trident1 event · 1 leak indicator
Australia7
  • Qilin2 events · 2 leak indicators
  • Aur0ra1 event · 1 leak indicator
  • DragonForce1 event · 1 leak indicator
  • Gentlemen1 event · 0 leak indicators
  • M3rx1 event · 0 leak indicators
  • Payload1 event · 1 leak indicator
Germany7
  • LockBit 5.02 events · 2 leak indicators
  • Qilin2 events · 2 leak indicators
  • Akira1 event · 1 leak indicator
  • Gentlemen1 event · 0 leak indicators
  • INC Ransom1 event · 1 leak indicator
Canada6
  • Qilin2 events · 0 leak indicators
  • Beast1 event · 0 leak indicators
  • M3rx1 event · 0 leak indicators
  • Payload1 event · 1 leak indicator
  • Rhysida1 event · 1 leak indicator
Italy5
  • Qilin3 events · 2 leak indicators
  • INC Ransom1 event · 1 leak indicator
  • M3rx1 event · 0 leak indicators
Indonesia4
  • Eraleignews1 event · 1 leak indicator
  • Everest1 event · 0 leak indicators
  • RansomHouse1 event · 0 leak indicators
  • World Leaks1 event · 1 leak indicator
China3
  • Gentlemen2 events · 0 leak indicators
  • BlackWater1 event · 0 leak indicators

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction11
  • Qilin5 events · 1 leak indicator
  • Gentlemen2 events · 0 leak indicators
  • INC Ransom2 events · 2 leak indicators
  • Brain Cipher1 event · 1 leak indicator
  • PEAR1 event · 1 leak indicator
Law Practice7
  • LeakedData2 events · 1 leak indicator
  • Aur0ra1 event · 1 leak indicator
  • CL0P1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • Payload1 event · 1 leak indicator
  • Qilin1 event · 0 leak indicators
Medical Practice7
  • Qilin2 events · 2 leak indicators
  • Beast1 event · 0 leak indicators
  • Eraleignews1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • Insomnia1 event · 1 leak indicator
  • M3rx1 event · 0 leak indicators
Retail7
  • DragonForce2 events · 2 leak indicators
  • Eraleignews1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • LockBit 5.01 event · 1 leak indicator
  • M3rx1 event · 0 leak indicators
  • Payload1 event · 1 leak indicator
Government Administration6
  • Everest1 event · 0 leak indicators
  • Gentlemen1 event · 0 leak indicators
  • INC Ransom1 event · 0 leak indicators
  • INTERLOCK1 event · 1 leak indicator
  • Payload1 event · 1 leak indicator
  • Qilin1 event · 1 leak indicator
Real Estate6
  • Aur0ra1 event · 1 leak indicator
  • Eraleignews1 event · 1 leak indicator
  • INC Ransom1 event · 1 leak indicator
  • Payouts King1 event · 1 leak indicator
  • Qilin1 event · 0 leak indicators
  • World Leaks1 event · 1 leak indicator
Hospitals and Health Care5
  • Eraleignews1 event · 1 leak indicator
  • Gentlemen1 event · 0 leak indicators
  • LockBit 5.01 event · 1 leak indicator
  • NightSpire1 event · 1 leak indicator
  • World Leaks1 event · 1 leak indicator
IT Services and IT Consulting5
  • Qilin2 events · 1 leak indicator
  • DragonForce1 event · 1 leak indicator
  • M3rx1 event · 0 leak indicators
  • World Leaks1 event · 1 leak indicator

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.
  • 51-200 employees 46
  • 11-50 employees 36
  • 1,001-5,000 employees 22
  • 201-500 employees 19
  • 501-1,000 employees 14
  • 2-10 employees 12

Notable actor profile updates

Active actor records only.
New ransom note observed
Exitium
2026-04-27 UTC
Adding newly observed ransom note, shared by ESET research. Thank you!
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.
Actor Sector Country Leak proof Seen
Payouts King Appliances, Electrical, and Electronics Manufacturing United States Data leak 2026-04-29
Payouts King Real Estate United States Data leak 2026-04-29
Payouts King Environmental Services United States Data leak 2026-04-29
INC Ransom Spring and Wire Product Manufacturing United States Data leak 2026-04-29
Krybit Insurance Zambia Claim only 2026-04-29
RADAR Investment Management United States Data leak 2026-04-29
Payload Retail Australia Data leak 2026-04-29
Qilin Retail Apparel and Fashion Italy Claim only 2026-04-29
Qilin Real Estate Canada Claim only 2026-04-29
Qilin Insurance United States Claim only 2026-04-29
Qilin Construction United States Claim only 2026-04-29
RansomHouse Motor Vehicle Manufacturing United States Data leak 2026-04-29

News and research context

Recent articles from the same time window.
VECT: Ransomware by design, Wiper by accident 2026-04-29
Related actor: Vect
Check Point Research discovers that the VECT 2.0 ransomware permanently destroys “large files” rather than encrypting them. A critical flaw in the encryption implementation, ident…
Generation Development Group reports cyber incident 2026-04-27
Generation Development Group Limited (‘GDG’ or ‘Company’) (ASX: GDG), advises that one of its subsidiary companies, Generation Life Limited, is responding to a contained cyber inc…
ITRON, INC. Cybersecurity Incident 2026-04-24
On April 13, 2026, Itron, Inc. (the “Company” or “Itron”) was notified that an unauthorized third party had gained access to certain of its systems. The Company activated its c…

Notes

  • Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
  • Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
  • Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
  • The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

  • The page uses a fixed seven-day window based on the selected date.
  • Only public-facing actor and event records are included.
  • Counts and breakdowns are designed for trend review, not incident confirmation.