2025 wurden 1.041 Ransomware-Angriffe angezeigt – ein Anstieg um zehn Prozent gegenüber dem Vorjahr. Besonders betroffen sind Unternehmen und öffentliche Einrichtungen. Die durchs…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2026-05-07 → 2026-05-13 UTC
Choose a report date
Observed events
175
Public claims in the selected week
Data leak indicators
104
59.4% of observed events
Active actors
37
Distinct groups with observed activity
Torrent-linked events
0
Events intersecting with torrent intelligence
What changed this week?
•
Qilin generated the highest visible claim volume this week, representing 18.9% of observed events.
•
59.4% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 11 observed events.
•
4 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
Coverage snapshot
As of 2026-05-13 UTC.
Leak sites observed this week
37
Leak sites online near report date
0
Threat actor profiles updated this week
4
Countries represented this week
36
Sectors represented this week
72
Top active actors
By observed claim volumeQilin
33 events · 14 leak indicators
Gentlemen
20 events · 1 leak indicator
Akira
15 events · 15 leak indicators
Genesis
12 events · 0 leak indicators
INC Ransom
12 events · 11 leak indicators
PLAY
10 events · 10 leak indicators
Lynx
8 events · 8 leak indicators
Lamashtu
6 events · 0 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- PLAY 10 events
- 3AM 2 events
- Money Message 1 event
- Nitrogen 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States87
- Qilin18 events · 5 leak indicators
- Akira10 events · 10 leak indicators
- INC Ransom10 events · 9 leak indicators
- Genesis8 events · 0 leak indicators
- PLAY8 events · 8 leak indicators
- Gentlemen4 events · 0 leak indicators
- INTERLOCK4 events · 4 leak indicators
- Lynx4 events · 4 leak indicators
Canada7
- PLAY2 events · 2 leak indicators
- Qilin2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- Aur0ra1 event · 1 leak indicator
- Genesis1 event · 0 leak indicators
United Kingdom7
- Qilin2 events · 1 leak indicator
- Brain Cipher1 event · 1 leak indicator
- FulcrumSec1 event · 1 leak indicator
- Genesis1 event · 0 leak indicators
- Gentlemen1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
Germany5
- Akira1 event · 1 leak indicator
- Gentlemen1 event · 1 leak indicator
- Kairos1 event · 1 leak indicator
- Lamashtu1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
Spain5
- Qilin2 events · 1 leak indicator
- Kairos1 event · 1 leak indicator
- Krybit1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
Taiwan5
- LockBit 5.02 events · 2 leak indicators
- Lynx1 event · 1 leak indicator
- Nitrogen1 event · 0 leak indicators
- World Leaks1 event · 1 leak indicator
France4
- Anubis1 event · 0 leak indicators
- BravoX1 event · 1 leak indicator
- DragonForce1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Mexico4
- Lamashtu2 events · 0 leak indicators
- BravoX1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction11
- Qilin4 events · 1 leak indicator
- Gentlemen3 events · 0 leak indicators
- PLAY2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- DragonForce1 event · 1 leak indicator
Law Practice9
- Qilin3 events · 1 leak indicator
- Genesis2 events · 0 leak indicators
- LeakedData2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
Architecture and Planning6
- Qilin2 events · 0 leak indicators
- Akira1 event · 1 leak indicator
- CMD Organization1 event · 1 leak indicator
- Genesis1 event · 0 leak indicators
- Gentlemen1 event · 0 leak indicators
IT Services and IT Consulting6
- Qilin2 events · 1 leak indicator
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Lamashtu1 event · 0 leak indicators
- PLAY1 event · 1 leak indicator
Financial Services5
- Gentlemen2 events · 0 leak indicators
- Akira1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- Leaknet Blog1 event · 1 leak indicator
Machinery Manufacturing5
- Gentlemen1 event · 1 leak indicator
- LockBit 5.01 event · 1 leak indicator
- Payouts King1 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Accounting4
- Anubis1 event · 0 leak indicators
- DragonForce1 event · 1 leak indicator
- PEAR1 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
Appliances, Electrical, and Electronics Manufacturing4
- Lamashtu1 event · 0 leak indicators
- Lynx1 event · 1 leak indicator
- Nitrogen1 event · 0 leak indicators
- Payload1 event · 1 leak indicator
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 11-50 employees 49
- 51-200 employees 42
- 2-10 employees 19
- 201-500 employees 17
- 1,001-5,000 employees 15
- 501-1,000 employees 6
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
Coinbase Cartel
2026-05-11 UTC
Contact information updated, only supporting TOX
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| INC Ransom | Semiconductor Manufacturing | United States | Data leak | 2026-05-13 |
| DragonForce | IT Services and IT Consulting | India | Data leak | 2026-05-13 |
| DragonForce | Real Estate | Sweden | Data leak | 2026-05-13 |
| DragonForce | Libraries | United States | Data leak | 2026-05-13 |
| Qilin | Hospitality | Australia | Data leak | 2026-05-13 |
| Qilin | Law Practice | United States | Claim only | 2026-05-13 |
| Qilin | Health, Wellness and Fitness | United States | Claim only | 2026-05-13 |
| Qilin | Architecture and Planning | United States | Claim only | 2026-05-13 |
| Qilin | Consumer Services | United States | Claim only | 2026-05-13 |
| Qilin | Construction | United States | Claim only | 2026-05-13 |
| Qilin | Law Practice | United States | Claim only | 2026-05-13 |
| Qilin | Legal Services | Singapore | Claim only | 2026-05-13 |
News and research context
Recent articles from the same time window.
Related actor: Nitrogen
A ransomware group is attempting to extort the electronics manufacturing giant Foxconn, claiming that it stole 8 terabytes of data from the company, including schematics and proje…
On May 7, 2026, West Pharmaceutical Services, Inc. (the “Company”) determined that the Company has experienced a material cybersecurity attack, in which certain data was exfiltrat…
Related actor: Gentlemen
The compromised communications included 8,200 lines of text from an internal chat tool, plus images of infected systems, and message timestamps largely corresponding to people who…
ALS Ltd (ASX: ALQ) has come under renewed investor scrutiny after disclosing a recent cyber security incident that temporarily disrupted some of its global operations. The company…
Arezzo, 10 maggio 2026 – Alla vigilia della grande mostra per i cento anni della sua storia e mentre Arezzo si preparava ad accendere le luci della fiera OroArezzo, il cuore digit…
Related actor: ShinyHunters
Universities across the US reported widespread outages on Thursday after a cybersecurity incident affected the Canvas online learning platform used by colleges nationwide.
The…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.