Weekly intelligence Trend-first

Weekly ransomware & data leak landscape

A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.

Window: 2026-04-26 → 2026-05-02 UTC

Choose a report date

Observed events

177

Public claims in the selected week

Data leak indicators

114

64.4% of observed events

Active actors

Distinct groups with observed activity

Torrent-linked events

Events intersecting with torrent intelligence

What changed this week?

•

Qilin generated the highest visible claim volume this week, representing 19.2% of observed events.

•

64.4% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.

•

Construction was the most represented sector in this window with 15 observed events.

•

8 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.

•

1 observed events in this week intersected with torrent intelligence, which is useful for understanding data-distribution tactics beyond plain leak-site posts.

•

2 tracked leak sites were still online as of the report date snapshot, giving useful context on current ecosystem churn and monitoring pressure.

Coverage snapshot

As of 2026-05-02 UTC.

Leak sites observed this week

Leak sites online near report date

Threat actor profiles updated this week

Countries represented this week

Sectors represented this week

Top active actors

By observed claim volume

Qilin

34 events · 14 leak indicators

Gentlemen

14 events · 0 leak indicators

DragonForce

13 events · 13 leak indicators

INC Ransom

12 events · 12 leak indicators

Eraleignews

9 events · 9 leak indicators

LockBit 5.0

8 events · 8 leak indicators

M3rx

8 events · 0 leak indicators

World Leaks

8 events · 8 leak indicators

Emerging or resurfacing actors

No matching activity in prior 30 days

M3rx 8 events
Aur0ra 7 events
CMD Organization 3 events
CL0P 1 event
Kill Security 1 event
RADAR 1 event
Rhysida 1 event
SecP0 1 event

Country mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

United States81

Qilin17 events · 6 leak indicators
DragonForce10 events · 10 leak indicators
INC Ransom9 events · 9 leak indicators
Aur0ra5 events · 5 leak indicators
Everest5 events · 4 leak indicators
Payouts King5 events · 4 leak indicators
PEAR3 events · 3 leak indicators
ShinyHunters3 events · 1 leak indicator

Canada10

Qilin3 events · 0 leak indicators
CMD Organization1 event · 1 leak indicator
Everest1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
Leaknet Blog1 event · 1 leak indicator
M3rx1 event · 0 leak indicators
Payload1 event · 1 leak indicator
Rhysida1 event · 1 leak indicator

Australia7

Aur0ra1 event · 1 leak indicator
DragonForce1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
M3rx1 event · 0 leak indicators
Payload1 event · 1 leak indicator
Qilin1 event · 1 leak indicator
SAFEPAY1 event · 1 leak indicator

Italy6

Qilin3 events · 2 leak indicators
INC Ransom1 event · 1 leak indicator
M3rx1 event · 0 leak indicators
RALord1 event · 1 leak indicator

United Kingdom5

M3rx2 events · 0 leak indicators
Qilin2 events · 1 leak indicator
Trident1 event · 1 leak indicator

China4

BlackWater2 events · 0 leak indicators
Gentlemen2 events · 0 leak indicators

France3

Aur0ra1 event · 1 leak indicator
BlackNevas1 event · 0 leak indicators
Qilin1 event · 0 leak indicators

Germany3

Gentlemen1 event · 0 leak indicators
Krybit1 event · 0 leak indicators
SAFEPAY1 event · 1 leak indicator

Sector mix

Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.

Construction15

Qilin6 events · 2 leak indicators
CMD Organization2 events · 2 leak indicators
Gentlemen2 events · 0 leak indicators
INC Ransom2 events · 2 leak indicators
PEAR2 events · 2 leak indicators
LockBit 5.01 event · 1 leak indicator

Retail8

DragonForce2 events · 2 leak indicators
Eraleignews1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
LockBit 5.01 event · 1 leak indicator
M3rx1 event · 0 leak indicators
Payload1 event · 1 leak indicator
Qilin1 event · 1 leak indicator

Real Estate7

Qilin2 events · 1 leak indicator
Aur0ra1 event · 1 leak indicator
Eraleignews1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
Payouts King1 event · 1 leak indicator
World Leaks1 event · 1 leak indicator

Hospitals and Health Care6

Eraleignews1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
Kill Security1 event · 1 leak indicator
Krybit1 event · 0 leak indicators
LockBit 5.01 event · 1 leak indicator
Qilin1 event · 0 leak indicators

Law Practice6

Aur0ra1 event · 1 leak indicator
CL0P1 event · 1 leak indicator
Everest1 event · 1 leak indicator
LeakedData1 event · 1 leak indicator
Qilin1 event · 0 leak indicators
World Leaks1 event · 1 leak indicator

Medical Practice6

Eraleignews1 event · 1 leak indicator
INC Ransom1 event · 1 leak indicator
Insomnia1 event · 1 leak indicator
M3rx1 event · 0 leak indicators
NightSpire1 event · 1 leak indicator
Qilin1 event · 0 leak indicators

Government Administration5

Everest1 event · 1 leak indicator
Gentlemen1 event · 0 leak indicators
INTERLOCK1 event · 1 leak indicator
Leaknet Blog1 event · 1 leak indicator
Payload1 event · 1 leak indicator

Insurance5

Eraleignews2 events · 2 leak indicators
Everest1 event · 1 leak indicator
Krybit1 event · 0 leak indicators
Qilin1 event · 0 leak indicators

Organization size bands

Share of weekly events by employee-size group across the last 12 reporting windows.

51-200 employees 49
11-50 employees 34
201-500 employees 24
1,001-5,000 employees 21
2-10 employees 13
501-1,000 employees 8

Notable actor profile updates

Active actor records only.

New ransom note observed

Exitium

2026-04-27 UTC

Adding newly observed ransom note, shared by ESET research. Thank you!

New actor infrastructure / contact channel

No infrastructure/contact-channel change logged in this reporting window.

New vuln / TTP intelligence

No vuln/TTP change logged in this reporting window.

Recent signal samples

Selected weekly signals.

Actor	Sector	Country	Leak proof	Seen
Qilin	Design Services	United States	Data leak	2026-05-02
Qilin	Newspaper Publishing	United States	Claim only	2026-05-02
Qilin	Software Development	United States	Claim only	2026-05-02
Qilin	Fabricated Metal Products	United States	Claim only	2026-05-02
Qilin	Construction	Canada	Claim only	2026-05-02
Qilin	Medical Practice	United States	Claim only	2026-05-02
CMD Organization	Construction	United States	Data leak	2026-05-02
CMD Organization	Construction	Canada	Data leak	2026-05-02
CMD Organization	Biotechnology Research	United States	Data leak	2026-05-02
PEAR	Construction	United States	Data leak	2026-05-02
BlackWater	Motor Vehicle Manufacturing	China	Claim only	2026-05-02
AiLock	Architecture and Planning	United States	Data leak	2026-05-02

News and research context

Recent articles from the same time window.

BC judge certifies class action over TransLink data breach - Business in Vancouver 2026-05-02

Related actor: Egregor

A B.C. judge has certified a class action lawsuit potentially involving nearly 39,000 people after their personal and financial information was accessed in a ransomware attack on…

Cyber attack shuts down Adams County servers; Week-long restoration effort continues 2026-04-30

Adams County government offices have been unable to conduct any online business for over a week due to a reported cyber attack. Officials said Wednesday that they expect to be…

ACL Subsidiary SunDoctors Hit by Contained Cyber Incident via External IT Provider 2026-04-30

Australian Clinical Labs has disclosed that an external IT service provider used by its SunDoctors subsidiary suffered a cyber incident, allowing unauthorised access to a limited…

City of Ardmore issues alert after ransomware attack | Oklahoma Headlines | kten.com 2026-04-30

ARDMORE, Okla. (KTEN) — The City of Ardmore is alerting the public after a ransomware attack earlier this month that may have involved personal information. According to a Face…

Stelia North America hacked in ransomware attack 2026-04-30

Related actor: Rhysida

Airbus-owned Stelia North America has been hacked in an apparent ransomware attack. In a statement, Steila confirmed the attack, saying: “Upon detection, we immediately activat…

VECT: Ransomware by design, Wiper by accident 2026-04-29

Related actor: Vect

Check Point Research discovers that the VECT 2.0 ransomware permanently destroys “large files” rather than encrypting them. A critical flaw in the encryption implementation, ident…

Kent District Library blames ‘ransomware’ for closures 2026-04-28

The Kent District Library says the computer system outage that closed all its branches is due to a “ransomware event.” The district recently discovered the event, but provided…

Asking around: the easiest ransomware attack signals to miss 2026-04-28

But if you didn’t see a red-flag signal during a scan of the network, you’re not alone: Almost 7,500 organizations around the world were hit by ransomware last year—and there are…

M3rx ransomware: inside a new leak-site actor and Go encryptor | Derp 2026-04-27

Related actor: M3rx

M3rx is a new ransomware name with a leak site, a Tox contact, and a Windows encryptor that is already doing real work. . It carries an embedded config, writes RECOVERY_NOTES.T…

Generation Development Group reports cyber incident 2026-04-27

Generation Development Group Limited (‘GDG’ or ‘Company’) (ASX: GDG), advises that one of its subsidiary companies, Generation Life Limited, is responding to a contained cyber inc…

Notes

Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.

Method

The page uses a fixed seven-day window based on the selected date.
Only public-facing actor and event records are included.
Counts and breakdowns are designed for trend review, not incident confirmation.