Dragons EyeRansomware tracker

US state reports

Ransomware claims against US organizations, by state

Which states ransomware groups name most often on their leak sites, how that changed over the last 12 months, and the latest claims we could place.

Data: ransomware.live · Statistics generated Oct 25, 2026, 06:11 UTC, refreshed hourly

Allegation by a ransomware group, not a confirmed attackRansomware groups post these claims themselves; we track them, we do not verify them.

US claims, last 12 months
4,825
Placed in a state
2,62654% of US claims
So far in October 2026
456Month in progress, not in the trend
Latest claim
Oct 25, 2026

Claims against US organizations per month

All US claims, located or not, in the last 12 complete months (UTC).

  1. October 2025: 442
  2. November 2025: 354
  3. December 2025: 379
  4. January 2026: 359
  5. February 2026: 376
  6. March 2026: 415
  7. April 2026: 352
  8. May 2026: 390
  9. June 2026: 309
  10. July 2026: 440
  11. August 2026: 549
  12. September 2026: 460

Most-named states

Claims placed in each state, last 12 complete months.

  1. California318
  2. Texas226
  3. New York189
  4. Florida169
  5. Illinois126
  6. Pennsylvania103
  7. Massachusetts102
  8. New Jersey88
  9. Michigan82
  10. Ohio81

Top sectors

All US claims with a sector label.

  1. Manufacturing596
  2. Healthcare services261
  3. Construction252
  4. Healthcare226
  5. Technology196
  6. Business Services185
  7. Professional Services185
  8. Attorney170

Top cities

Only addresses confirmed on organizations' own websites.

  1. New York, NY56
  2. Houston, TX42
  3. Dallas, TX23
  4. Chicago, IL21
  5. Atlanta, GA17
  6. Los Angeles, CA14
  7. Milwaukee, WI13
  8. Washington, DC13

Latest claims against US organizations

Allegation by a ransomware group, not a confirmed attackEach row is a claim posted on a ransomware leak site. Inclusion does not mean the organization was breached.

The 25 most recent claims against US organizations, newest first. Dates are when a tracked source first observed the claim (UTC).
ObservedOrganizationGroupSectorLocationEvidence
Oct 25, 2026Newcomer Cremations, Funerals & ReceptionsanubisHealthcare— Not located2+ sources
Oct 24, 2026Heber City, UTqilinGovernment & Defense— Not located2+ sources
Oct 24, 2026choicegoodwill.comkrybitRetail & E-Commerce— Not located2+ sources
Oct 24, 2026Adirondack Networksn0nTechnology— Not locatedSingle source
Oct 24, 2026Arthritis Center of Riversiden0nHealthcare— Not located2+ sources
Oct 24, 2026Adirondack Networks, Inc.n0nTechnology— Not located2+ sources
Oct 24, 2026Commonwealth Community BankqilinFinancial Services— Not located2+ sources
Oct 24, 2026Trinity Custom HomesdeadlockManufacturing— Not located2+ sources
Oct 23, 2026Penco Productsthe gentlemenManufacturing— Not located2+ sources
Oct 23, 2026Bruin Group LLCWhitearmorNot reported— Not locatedSingle source
Oct 23, 2026JB HuntWhitearmorTransportation— Not located2+ sources
Oct 23, 2026JS Constructor, INCemperadorManufacturing— Not located2+ sources
Oct 23, 2026mickeybody.comchaosRetail & E-Commerce— Not located2+ sources
Oct 23, 2026Don Pickett & AssociatessarcomaNot reported— Not locatedSingle source
Oct 23, 2026Red Oak Technologiesthe gentlemenTechnology— Not located2+ sources
Oct 23, 2026vinsolutions.comScarlettgroupProfessional Services— Not located2+ sources
Oct 23, 2026EMARKETERfulcrumsecTechnology— Not located2+ sources
Oct 23, 2026Prism Medical ProductsWallstreetHealthcare— Not located2+ sources
Oct 22, 2026Barrow & GrimmbravoxNot reported— Not located2+ sources
Oct 22, 2026Kirkland & Ellis LLPSilentRansomGroupBusiness Services— Not located2+ sources
Oct 22, 2026United Restaurant SupplyqilinHospitality— Not located2+ sources
Oct 22, 2026Bethany Press InternationalakiraRetail & E-Commerce— Not located2+ sources
Oct 22, 2026Line2Line CoatingsrhysidaManufacturing— Not located2+ sources
Oct 22, 2026AnnapathakiraNot reported— Not located2+ sources
Oct 22, 2026Performance Ford Incn0nRetail & E-Commerce— Not located2+ sources

All states

Located claims in the last 12 complete months.

How claims are placed in states

  • Own website (confirmed). A US street address with a ZIP code that belongs to the state, found on the organization's own home, contact or about page. Pages are fetched politely and robots.txt is respected.
  • Named in claim (inferred). The claim text itself names the state, for example "based in Austin, Texas". City names from claim text are never shown, because ransomware groups write that text.
  • Never guessed. We do not place claims from a company name, a phone area code, a paid registry or a map lookup. A claim we cannot place stays in the national count and on no state page.
  • Window. Trends cover the last 12 complete calendar months (UTC). The current month is shown separately because it is still in progress.

Claims come from public ransomware leak sites as collected by our sources. Read the methodology for how claims are collected, corroborated and corrected.