Unverified ransomware leak-site claims, counted from RansomLook. Published 2026-10-17. Data (JSON)
Ransomware gangs posted 967 claims on their leak sites in September 2026, down 20.9% from 1,222 in August 2026. 80 groups posted at least once, compared with 82 in August 2026.
The Gentlemen led with 106, followed by Qilin (74) and Storm (66).
The biggest drops came from groups that were very busy in August 2026: Qilin went from 165 to 74, Clop went from 87 to 25, The Gentlemen went from 162 to 106.
Groups that grew: Storm (12 to 66), Killsec3 (0 to 46), Audit Team (4 to 26), Safepay (12 to 32). 20 groups posted this month that had no posts in August 2026.
| # | Group | September 2026 | August 2026 | Change |
|---|---|---|---|---|
| 1 | the gentlemen | 106 | 162 | -56 |
| 2 | qilin | 74 | 165 | -91 |
| 3 | storm | 66 | 12 | +54 |
| 4 | killsec3 | 46 | 0 | +46 |
| 5 | akira | 36 | 30 | +6 |
| 6 | inc ransom | 35 | 43 | -8 |
| 7 | krybit | 35 | 36 | -1 |
| 8 | safepay | 32 | 12 | +20 |
| 9 | audit team | 26 | 4 | +22 |
| 10 | clop | 25 | 87 | -62 |
black nevas, blacklocks, embargo, endzone, fulcrumsec, global cybernetic collective, imnotavillian, kazu, killsec3, lamashtu, metaencryptor, n0n, secp0, shiba, spirals, tridentlocker, ulose, vexy, vladivostok, vypr
Sector, country and US-state breakdowns are coming once a licensed source with those fields is connected.
Check a company or domain against these claims with the pay-per-call API: api.ransomware-tracker.com (lookup $0.01, bulk vendor check $0.50, vendor risk report $3; x402 USDC on Base; MCP at /mcp). Free coverage check: /v1/coverage.
These are unverified claims posted by criminal groups on their leak sites, not confirmed breaches. Groups exaggerate, repost old data and sometimes list the wrong company. Do not use a listing to contact, shame or harm anyone named.
Source: RansomLook monthly posts, licensed CC BY 4.0. A claim is one unique (victim name, group) pair whose RansomLook discovery time falls in the month. 968 raw posts became 967 claims after removing duplicates (August 2026: 1223 raw, 1222 claims). Discovery time is when RansomLook saw the post, not when the attack happened. Leak sites that go offline, or posts removed before RansomLook sees them, are not counted, so treat these as a floor.
Attribution: data from RansomLook (CC BY 4.0). Changes: deduplicated and aggregated by Dragons Eye.