On May 7, 2026, West Pharmaceutical Services, Inc. (the “Company”) determined that the Company has experienced a material cybersecurity attack, in which certain data was exfiltrat…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2026-05-06 → 2026-05-12 UTC
Choose a report date
Observed events
213
Public claims in the selected week
Data leak indicators
113
53.1% of observed events
Active actors
38
Distinct groups with observed activity
Torrent-linked events
0
Events intersecting with torrent intelligence
What changed this week?
•
Gentlemen generated the highest visible claim volume this week, representing 15.0% of observed events.
•
53.1% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 14 observed events.
•
5 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
Coverage snapshot
As of 2026-05-12 UTC.
Leak sites observed this week
38
Leak sites online near report date
0
Threat actor profiles updated this week
3
Countries represented this week
41
Sectors represented this week
80
Top active actors
By observed claim volumeGentlemen
32 events · 1 leak indicator
Qilin
30 events · 14 leak indicators
Akira
17 events · 17 leak indicators
Bavacai
16 events · 4 leak indicators
Genesis
12 events · 0 leak indicators
INC Ransom
12 events · 10 leak indicators
PLAY
10 events · 10 leak indicators
SAFEPAY
9 events · 9 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- Bavacai 16 events
- 3AM 2 events
- Icarus 1 event
- Money Message 1 event
- Nitrogen 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States94
- Akira12 events · 12 leak indicators
- Qilin12 events · 5 leak indicators
- INC Ransom10 events · 8 leak indicators
- Genesis8 events · 0 leak indicators
- PLAY8 events · 8 leak indicators
- Gentlemen7 events · 0 leak indicators
- Bavacai4 events · 1 leak indicator
- INTERLOCK4 events · 4 leak indicators
United Kingdom10
- Gentlemen2 events · 0 leak indicators
- Qilin2 events · 1 leak indicator
- Akira1 event · 1 leak indicator
- Brain Cipher1 event · 1 leak indicator
- FulcrumSec1 event · 1 leak indicator
- Genesis1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
- SAFEPAY1 event · 1 leak indicator
Canada8
- PLAY2 events · 2 leak indicators
- Qilin2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- Aur0ra1 event · 0 leak indicators
- Genesis1 event · 0 leak indicators
- M3rx1 event · 0 leak indicators
Germany7
- SAFEPAY2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- Gentlemen1 event · 1 leak indicator
- Kairos1 event · 1 leak indicator
- Lamashtu1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
Italy6
- Gentlemen2 events · 0 leak indicators
- Qilin2 events · 0 leak indicators
- SAFEPAY2 events · 2 leak indicators
Spain6
- Qilin2 events · 1 leak indicator
- Kairos1 event · 1 leak indicator
- Krybit1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
- SAFEPAY1 event · 1 leak indicator
Taiwan5
- LockBit 5.02 events · 2 leak indicators
- Lynx1 event · 1 leak indicator
- Nitrogen1 event · 0 leak indicators
- World Leaks1 event · 1 leak indicator
Thailand5
- Lamashtu2 events · 0 leak indicators
- Qilin2 events · 2 leak indicators
- Gentlemen1 event · 0 leak indicators
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction14
- Gentlemen4 events · 0 leak indicators
- Qilin4 events · 2 leak indicators
- PLAY2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- Bavacai1 event · 0 leak indicators
- DragonForce1 event · 1 leak indicator
- SAFEPAY1 event · 1 leak indicator
Architecture and Planning8
- Gentlemen2 events · 0 leak indicators
- Akira1 event · 1 leak indicator
- CMD Organization1 event · 1 leak indicator
- Genesis1 event · 0 leak indicators
- Lamashtu1 event · 0 leak indicators
- Qilin1 event · 0 leak indicators
- Sinobi1 event · 1 leak indicator
Law Practice8
- LeakedData3 events · 3 leak indicators
- Genesis2 events · 0 leak indicators
- Akira1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
Manufacturing7
- Akira2 events · 2 leak indicators
- AiLock1 event · 1 leak indicator
- Aur0ra1 event · 0 leak indicators
- Bavacai1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
- SAFEPAY1 event · 1 leak indicator
Retail7
- Gentlemen2 events · 0 leak indicators
- Lamashtu2 events · 0 leak indicators
- Bavacai1 event · 0 leak indicators
- INC Ransom1 event · 1 leak indicator
- M3rx1 event · 0 leak indicators
Hospitals and Health Care6
- Akira2 events · 2 leak indicators
- Everest1 event · 0 leak indicators
- Genesis1 event · 0 leak indicators
- INC Ransom1 event · 0 leak indicators
- Space Bears1 event · 1 leak indicator
IT Services and IT Consulting6
- Qilin2 events · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Lamashtu1 event · 0 leak indicators
- M3rx1 event · 0 leak indicators
- PLAY1 event · 1 leak indicator
Software Development6
- INC Ransom2 events · 2 leak indicators
- Bavacai1 event · 1 leak indicator
- Genesis1 event · 0 leak indicators
- Gentlemen1 event · 0 leak indicators
- Icarus1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 11-50 employees 57
- 51-200 employees 53
- 201-500 employees 27
- 2-10 employees 18
- 1,001-5,000 employees 13
- 501-1,000 employees 10
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
Coinbase Cartel
2026-05-11 UTC
Contact information updated, only supporting TOX
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| Qilin | Design Services | United States | Claim only | 2026-05-12 |
| Qilin | Security and Investigations | Ukraine | Data leak | 2026-05-12 |
| PLAY | Machinery Manufacturing | United States | Data leak | 2026-05-12 |
| PLAY | Real Estate | Canada | Data leak | 2026-05-12 |
| PLAY | Truck Transportation | United States | Data leak | 2026-05-12 |
| PLAY | Construction | United States | Data leak | 2026-05-12 |
| PLAY | Construction | United States | Data leak | 2026-05-12 |
| PLAY | Travel Arrangements | United States | Data leak | 2026-05-12 |
| PLAY | IT Services and IT Consulting | United States | Data leak | 2026-05-12 |
| Gentlemen | Wholesale Import and Export | Thailand | Claim only | 2026-05-12 |
| Gentlemen | Financial Services | Singapore | Claim only | 2026-05-12 |
| Gentlemen | Food and Beverage Manufacturing | United Kingdom | Claim only | 2026-05-12 |
News and research context
Recent articles from the same time window.
Related actor: Gentlemen
The compromised communications included 8,200 lines of text from an internal chat tool, plus images of infected systems, and message timestamps largely corresponding to people who…
ALS Ltd (ASX: ALQ) has come under renewed investor scrutiny after disclosing a recent cyber security incident that temporarily disrupted some of its global operations. The company…
Arezzo, 10 maggio 2026 – Alla vigilia della grande mostra per i cento anni della sua storia e mentre Arezzo si preparava ad accendere le luci della fiera OroArezzo, il cuore digit…
Related actor: ShinyHunters
Universities across the US reported widespread outages on Thursday after a cybersecurity incident affected the Canvas online learning platform used by colleges nationwide.
The…
Related actor: Chaos
In early 2026, a sophisticated intrusion initially appearing to be a standard Chaos ransomware attack was assessed to be consistent with a targeted state-sponsored operation. Whil…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.