Evertec, Inc. (NYSE:EVTC) disclosed Monday that it identified potential unauthorized access to customer data on May 13, 2026. The company reported in a statement based on an SEC f…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2026-06-03 → 2026-06-09 UTC
Choose a report date
Observed events
134
Public claims in the selected week
Data leak indicators
82
61.2% of observed events
Active actors
35
Distinct groups with observed activity
Torrent-linked events
0
Events intersecting with torrent intelligence
What changed this week?
•
Gentlemen generated the highest visible claim volume this week, representing 17.9% of observed events.
•
61.2% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 9 observed events.
•
3 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
Coverage snapshot
As of 2026-06-09 UTC.
Leak sites observed this week
35
Leak sites online near report date
0
Threat actor profiles updated this week
3
Countries represented this week
36
Sectors represented this week
67
Top active actors
By observed claim volumeGentlemen
24 events · 1 leak indicator
Qilin
21 events · 16 leak indicators
Akira
14 events · 13 leak indicators
LockBit 5.0
8 events · 7 leak indicators
INC Ransom
7 events · 1 leak indicator
NightSpire
6 events · 4 leak indicators
World Leaks
6 events · 6 leak indicators
PLAY
5 events · 5 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- BlackWater 1 event
- Embargo 1 event
- Insomnia 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States55
- Akira11 events · 10 leak indicators
- Qilin9 events · 7 leak indicators
- Gentlemen8 events · 1 leak indicator
- PLAY5 events · 5 leak indicators
- INC Ransom3 events · 1 leak indicator
- NightSpire3 events · 3 leak indicators
- Termite3 events · 3 leak indicators
- Anubis2 events · 0 leak indicators
India7
- Gentlemen2 events · 0 leak indicators
- World Leaks2 events · 2 leak indicators
- Kill Security1 event · 1 leak indicator
- Morpheus1 event · 0 leak indicators
- RALord1 event · 1 leak indicator
China6
- Gentlemen3 events · 0 leak indicators
- BlackWater1 event · 0 leak indicators
- Krybit1 event · 0 leak indicators
- RansomHouse1 event · 0 leak indicators
Germany6
- Akira1 event · 1 leak indicator
- DragonForce1 event · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- LockBit 5.01 event · 0 leak indicators
- Qilin1 event · 0 leak indicators
- Space Bears1 event · 1 leak indicator
Canada4
- Qilin2 events · 2 leak indicators
- Akira1 event · 1 leak indicator
- Stormous1 event · 1 leak indicator
Taiwan4
- LockBit 5.02 events · 2 leak indicators
- Gentlemen1 event · 0 leak indicators
- Krybit1 event · 0 leak indicators
Thailand4
- Gentlemen2 events · 0 leak indicators
- Qilin1 event · 1 leak indicator
- World Leaks1 event · 1 leak indicator
United Kingdom4
- Anubis1 event · 0 leak indicators
- INC Ransom1 event · 0 leak indicators
- Prinz Eugen1 event · 1 leak indicator
- ShinyHunters1 event · 1 leak indicator
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction9
- Gentlemen2 events · 0 leak indicators
- Anubis1 event · 0 leak indicators
- Embargo1 event · 1 leak indicator
- INC Ransom1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
- Space Bears1 event · 1 leak indicator
- Termite1 event · 1 leak indicator
- World Leaks1 event · 1 leak indicator
Hospitals and Health Care7
- Anubis1 event · 0 leak indicators
- Gentlemen1 event · 0 leak indicators
- Kill Security1 event · 1 leak indicator
- LockBit 5.01 event · 1 leak indicator
- Qilin1 event · 1 leak indicator
- RALord1 event · 1 leak indicator
- World Leaks1 event · 1 leak indicator
Financial Services5
- Akira1 event · 1 leak indicator
- INC Ransom1 event · 0 leak indicators
- NightSpire1 event · 1 leak indicator
- Space Bears1 event · 1 leak indicator
- World Leaks1 event · 1 leak indicator
Appliances, Electrical, and Electronics Manufacturing4
- Gentlemen3 events · 0 leak indicators
- Krybit1 event · 0 leak indicators
Automation Machinery Manufacturing4
- Akira2 events · 2 leak indicators
- INC Ransom1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Food and Beverage Manufacturing4
- Qilin2 events · 1 leak indicator
- Gentlemen1 event · 0 leak indicators
- Termite1 event · 1 leak indicator
Law Practice4
- Anubis1 event · 0 leak indicators
- Gunra1 event · 1 leak indicator
- INC Ransom1 event · 0 leak indicators
- PLAY1 event · 1 leak indicator
Medical Practice4
- Gentlemen3 events · 0 leak indicators
- Genesis1 event · 0 leak indicators
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 11-50 employees 30
- 51-200 employees 28
- 201-500 employees 22
- 2-10 employees 13
- 1,001-5,000 employees 12
- 501-1,000 employees 10
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
Handala
2026-06-08 UTC
Adding new Telegram channel
New vuln / TTP intelligence
Qilin
2026-06-08 UTC
Adding newly observed CVE
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| Termite | Food and Beverage Manufacturing | United States | Data leak | 2026-06-09 |
| ShinyHunters | Research Services | United Kingdom | Data leak | 2026-06-09 |
| Insomnia | Human Resources Services | United States | Data leak | 2026-06-09 |
| Embargo | Construction | United States | Data leak | 2026-06-09 |
| World Leaks | Wholesale Building Materials | India | Data leak | 2026-06-09 |
| World Leaks | Financial Services | India | Data leak | 2026-06-09 |
| World Leaks | Transportation, Logistics, Supply Chain and Storage | Sweden | Data leak | 2026-06-09 |
| LockBit 5.0 | Architecture and Planning | United States | Data leak | 2026-06-09 |
| LockBit 5.0 | Machinery Manufacturing | Germany | Claim only | 2026-06-09 |
| Chaos | Telecommunications | United States | Data leak | 2026-06-09 |
| Akira | Automation Machinery Manufacturing | United States | Data leak | 2026-06-09 |
| Akira | Hospitality | United States | Data leak | 2026-06-09 |
News and research context
Recent articles from the same time window.
Related actor: Qilin
Check Point Research has identified active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN and Mobile Access…
DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
2026-06-08
Related actor: PLAY
Grixba is a custom Infostealer developed by Play Ransomware Group using Costura (.NET tool for embedding dependencies into single executable), which is publicly disclosed in 2023…
Related actor: Handala
The Women's News Agency (NÛJINHA) disclosed that it has suffered a cyber attack and received threatening messages, emphasizing that this targeting carries political dimensions aim…
On June 7, 2026, a ransomware attack disrupted access to district systems, internet services, and computer infrastructure. Due to this incident, Evanston Township High School will…
Chandrapur Cancer Hospital Hit by Ransomware Attack, Hackers Demand Rs 75 Lakh - The Live Nagpur
2026-06-06
A major cyberattack has targeted the Chandrapur Cancer Care Foundation (Cancer Hospital), with hackers allegedly encrypting the hospital’s entire database and demanding a ransom o…
Related actor: LeakedData
From January through May 2026, Mandiant identified a financially motivated data theft extortion campaign executed by the threat cluster UNC3753 (also tracked as "Luna Moth," “Chat…
Powys County Council is responding to a cyber security incident affecting some school systems, which has resulted in unauthorised access to some personal data.
The incident was i…
Lyne compared the underground landscape to a bar where threat actors can "get everything but a good drink."
"It felt like cyber threats were all quite stovepiped. You had hackt…
Wadern, 29. Mai 2026 – Die unimed Abrechnungservice für Kliniken und Chefärzte GmbH arbeitet nach einem Cyberangriff eng mit ihren Kunden zusammen, um die betroffenen Patienten üb…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.