{
 "month": "2026-09",
 "prev_month": "2026-08",
 "source": "RansomLook /api/posts/{y}/{m} (CC BY 4.0)",
 "raw_rows": 968,
 "claims": 967,
 "prev_raw_rows": 1223,
 "prev_claims": 1222,
 "mom_change_pct": -20.9,
 "active_groups": 80,
 "prev_active_groups": 82,
 "top_groups": [
  {
   "group": "the gentlemen",
   "claims": 106,
   "prev": 162
  },
  {
   "group": "qilin",
   "claims": 74,
   "prev": 165
  },
  {
   "group": "storm",
   "claims": 66,
   "prev": 12
  },
  {
   "group": "killsec3",
   "claims": 46,
   "prev": 0
  },
  {
   "group": "akira",
   "claims": 36,
   "prev": 30
  },
  {
   "group": "inc ransom",
   "claims": 35,
   "prev": 43
  },
  {
   "group": "krybit",
   "claims": 35,
   "prev": 36
  },
  {
   "group": "safepay",
   "claims": 32,
   "prev": 12
  },
  {
   "group": "audit team",
   "claims": 26,
   "prev": 4
  },
  {
   "group": "clop",
   "claims": 25,
   "prev": 87
  }
 ],
 "new_groups_vs_prev": [
  "black nevas",
  "blacklocks",
  "embargo",
  "endzone",
  "fulcrumsec",
  "global cybernetic collective",
  "imnotavillian",
  "kazu",
  "killsec3",
  "lamashtu",
  "metaencryptor",
  "n0n",
  "secp0",
  "shiba",
  "spirals",
  "tridentlocker",
  "ulose",
  "vexy",
  "vladivostok",
  "vypr"
 ],
 "computed_at": "2026-10-17T23:14:48.631Z",
 "published": "2026-10-17",
 "license": "CC BY 4.0 (RansomLook data, aggregated by Dragons Eye)",
 "note": "Unverified ransomware leak-site claims, not confirmed breaches."
}