Dragons EyeRansomware tracker

US state report · IL

Ransomware claims in Illinois

Claims that ransomware groups posted against organizations we could place in Illinois, over the last 12 complete months.

Data: ransomware.live · Statistics generated Oct 25, 2026, 07:18 UTC, refreshed hourly

Allegation by a ransomware group, not a confirmed attackRansomware groups post these claims themselves; we track them, we do not verify them.

Claims, last 12 months
126
So far in October 2026
5Month in progress, not in the trend
Address on own website
102Confirmed location
State named in claim
24Inferred location
Latest claim
Oct 15, 2026

Claims per month in Illinois

Located Illinois claims in the last 12 complete months (UTC).

  1. October 2025: 9
  2. November 2025: 15
  3. December 2025: 11
  4. January 2026: 8
  5. February 2026: 10
  6. March 2026: 9
  7. April 2026: 6
  8. May 2026: 11
  9. June 2026: 11
  10. July 2026: 16
  11. August 2026: 5
  12. September 2026: 15

Top sectors

5 claims had no sector label and are not shown.

  1. Manufacturing29
  2. Financial Services7
  3. Technology7
  4. Construction6
  5. Healthcare6
  6. Attorney5
  7. Healthcare services5
  8. Real Estate / Real Estate Management5

Top cities

Only addresses confirmed on organizations' own websites.

  1. Chicago21
  2. Schaumburg4
  3. Hoffman Estates3
  4. Morton Grove3
  5. Northbrook3
  6. Alsip2
  7. Bloomington2
  8. Carbondale2

Latest claims in Illinois

Allegation by a ransomware group, not a confirmed attackEach row is a claim posted on a ransomware leak site. Inclusion does not mean the organization was breached.

The 25 most recent claims placed in Illinois, newest first. Dates are when a tracked source first observed the claim (UTC).
ObservedOrganizationGroupSectorLocationEvidence
Oct 15, 2026middlebyIah647ManufacturingIL Named in claim2+ sources
Oct 14, 2026joliet86.orgqilinGovernmentJoliet, IL Own website2+ sources
Oct 12, 2026Engineers Contractors Fabricators Inc.interlockConstructionColumbia, IL Own websiteSingle source
Oct 8, 2026Baker McKenzieSilentRansomGroupLegal consultingIL Named in claim2+ sources
Oct 5, 2026Champaign Unit 4 School DistrictvyprSchoolsChampaign, IL Own website2+ sources
Sep 29, 2026Unique Repair ServiceskairosNot reportedDes Plaines, IL Own website2+ sources
Sep 29, 2026Gibson Area Hospital & Health ServicesWallstreetHealthcare servicesGibson City, IL Own website2+ sources
Sep 27, 2026First Secure Bank GroupStormFinanceIL Named in claim2+ sources
Sep 23, 2026Kirkland-And-Ellis.LlpclopAttorneyIL Named in claim2+ sources
Sep 18, 2026First Secure Bank and TrustStormFinancial ServicesIL Named in claim2+ sources
Sep 18, 2026The State BankStormFinancial ServicesIL Named in claim2+ sources
Sep 18, 2026First Secure Community BankStormFinancial ServicesIL Named in claim2+ sources
Sep 9, 2026cullottalaw.comINC RansomAttorneyIL Named in claim2+ sources
Sep 8, 2026CreateASoftakiraTechnologiesAurora, IL Own websiteSingle source
Sep 5, 2026Spirit Cultural Exchange - USkazuEducationOak Park, IL Own website2+ sources
Sep 4, 2026Wolfram ResearchdirewolfTechnologiesIL Named in claim2+ sources
Sep 4, 2026Veradigmthe gentlemenHealthcareChicago, IL Own websiteAuthority-confirmed
Sep 3, 2026GSAC Auto FinancingStormFinancial ServicesIL Named in claim2+ sources
Sep 3, 2026GSACStormNot reportedDowners Grove, IL Own website2+ sources
Sep 3, 2026Chicago Partners Wealth AdvisorsStormWealth ManagementChicago, IL Own website2+ sources
Aug 28, 2026H.W. LochnerpayoutskingProfessional ServicesIL Named in claim2+ sources
Aug 26, 2026mat-holdings-incIah647ManufacturingLong Grove, IL Own website2+ sources
Aug 21, 2026Deer Creek-Mackinaw CUSDdirewolfEducationSt. Mackinaw, IL Own website2+ sources
Aug 17, 2026Woodhaven AssociationplayNot reportedIL Own website2+ sources
Aug 12, 2026Archergrey.ComclopNot reportedKildeer, IL Own website2+ sources

Other states

Located claims in the last 12 complete months.

How claims are placed in states

  • Own website (confirmed). A US street address with a ZIP code that belongs to the state, found on the organization's own home, contact or about page. Pages are fetched politely and robots.txt is respected.
  • Named in claim (inferred). The claim text itself names the state, for example "based in Austin, Texas". City names from claim text are never shown, because ransomware groups write that text.
  • Never guessed. We do not place claims from a company name, a phone area code, a paid registry or a map lookup. A claim we cannot place stays in the national count and on no state page.
  • Window. Trends cover the last 12 complete calendar months (UTC). The current month is shown separately because it is still in progress.

Claims come from public ransomware leak sites as collected by our sources. Read the methodology for how claims are collected, corroborated and corrected.