Dragons EyeRansomware tracker

US state report · MI

Ransomware claims in Michigan

Claims that ransomware groups posted against organizations we could place in Michigan, over the last 12 complete months.

Data: ransomware.live · Statistics generated Oct 25, 2026, 07:18 UTC, refreshed hourly

Allegation by a ransomware group, not a confirmed attackRansomware groups post these claims themselves; we track them, we do not verify them.

Claims, last 12 months
82
So far in October 2026
2Month in progress, not in the trend
Address on own website
72Confirmed location
State named in claim
10Inferred location
Latest claim
Oct 13, 2026

Claims per month in Michigan

Located Michigan claims in the last 12 complete months (UTC).

  1. October 2025: 8
  2. November 2025: 5
  3. December 2025: 11
  4. January 2026: 4
  5. February 2026: 5
  6. March 2026: 7
  7. April 2026: 6
  8. May 2026: 4
  9. June 2026: 4
  10. July 2026: 11
  11. August 2026: 11
  12. September 2026: 6

Top sectors

3 claims had no sector label and are not shown.

  1. Manufacturing17
  2. Automotive7
  3. Healthcare services7
  4. Attorney4
  5. Construction4
  6. Healthcare3
  7. Logistics3
  8. Consulting2

Top cities

Only addresses confirmed on organizations' own websites.

  1. Ann Arbor4
  2. Grand Rapids4
  3. Kalamazoo4
  4. Muskegon3
  5. Sterling Heights3
  6. Detroit2
  7. Farmington Hills2
  8. Livonia2

Latest claims in Michigan

Allegation by a ransomware group, not a confirmed attackEach row is a claim posted on a ransomware leak site. Inclusion does not mean the organization was breached.

The 25 most recent claims placed in Michigan, newest first. Dates are when a tracked source first observed the claim (UTC).
ObservedOrganizationGroupSectorLocationEvidence
Oct 13, 2026PG Group (Pure Options)n0nFinancial ServicesMI Own website2+ sources
Oct 5, 2026H&L ManufacturinginterlockManufacturingMiddleville, MI Own website2+ sources
Sep 28, 2026Arnold CenterqilinCulture and entertainmentMidland, MI Own website2+ sources
Sep 23, 2026goldstarfinancial.comBrainCipherFinanceAnn Arbor, MI Own website2+ sources
Sep 22, 2026Clark HillSilentRansomGroupAttorneyMI Named in claim2+ sources
Sep 22, 2026Coe Press EquipmentakiraManufacturingSterling Heights, MI Own website2+ sources
Sep 18, 2026Prefix CorpsecurotropNot reportedMI Own website2+ sources
Sep 16, 2026Blossomland AccountingakiraProfessional ServicesMI Own website2+ sources
Aug 31, 2026ccsperfusion.comBrainCipherHealthcare servicesPlymouth, MI Own website2+ sources
Aug 31, 2026Ishbia & Gagleard, P.C.auroraAttorneyBirmingham, MI Own website2+ sources
Aug 27, 2026Bandit IndustriesqilinNot reportedRemus, MI Own website2+ sources
Aug 23, 2026AutoDieStormAutomotiveMI Named in claim2+ sources
Aug 21, 2026Battle Creek Public SchoolsrhysidaSchoolsBattle Creek, MI Own websiteSingle source
Aug 21, 2026ESCON Groupthe gentlemenReal Estate / Real Estate ManagementMI Named in claim2+ sources
Aug 18, 2026Standard Tool & DieStormManufacturingStevensville, MI Own website2+ sources
Aug 17, 2026Lansing Urgent CareINC RansomHealthcare servicesMI Own website2+ sources
Aug 5, 2026Mayco InternationalDark ProjectAutomotiveSterling Heights, MI Own website2+ sources
Aug 4, 2026Cardiology AssociatesOrovaHealthcare servicesPort Huron, MI Own website2+ sources
Aug 3, 2026Belasco ElectricakiraConstructionMuskegon, MI Own website2+ sources
Jul 31, 2026hutchpaving.comthe gentlemenBusiness ServicesWarren, MI Own website2+ sources
Jul 31, 2026Betz IndustriesBooba ProjectManufacturingGrand Rapids, MI Own website2+ sources
Jul 23, 2026Greater Michigan Distributorskillsec3Transportation/LogisticsMI Own websiteSingle source
Jul 23, 2026McCally Tool and Supplykillsec3ManufacturingLivonia, MI Own websiteSingle source
Jul 23, 2026Design Designkillsec3Retail & E-CommerceGrand Rapids, MI Own websiteSingle source
Jul 10, 2026Gene Codes Forensicsthe gentlemenHealthcareAnn Arbor, MI Own website2+ sources

Other states

Located claims in the last 12 complete months.

How claims are placed in states

  • Own website (confirmed). A US street address with a ZIP code that belongs to the state, found on the organization's own home, contact or about page. Pages are fetched politely and robots.txt is respected.
  • Named in claim (inferred). The claim text itself names the state, for example "based in Austin, Texas". City names from claim text are never shown, because ransomware groups write that text.
  • Never guessed. We do not place claims from a company name, a phone area code, a paid registry or a map lookup. A claim we cannot place stays in the national count and on no state page.
  • Window. Trends cover the last 12 complete calendar months (UTC). The current month is shown separately because it is still in progress.

Claims come from public ransomware leak sites as collected by our sources. Read the methodology for how claims are collected, corroborated and corrected.