Ransomware Tracker
Global Ransomware Dashboard
Livesynced 8m agoRequest assessment
Live ransomware intelligence
Global Ransomware Dashboard
2026-09-14 → 2026-09-23Tracking 53 groups6,229 victim records
Total Events
271
▲ 38.3% vs prior period
Active Groups
21
▲ 16.7% vs prior period
Data Leaks Posted
197
▲ 14.5% vs prior period
24h Change
+38.3%
▲ 38.3% vs prior window
Geographic Threat Heatmap
4,343Total attacks+38.3%
Loading map…
Most active groups (10d)All groups
| qilin | 37 | 43.5% |
| akira | 17 | 20.0% |
| safepay | 8 | 9.4% |
| incransom | 7 | 8.2% |
| play | 5 | 5.9% |
| silentransomgroup | 3 | 3.5% |
| interlock | 2 | 2.4% |
| rhysida | 2 | 2.4% |
| blacknevas | 1 | 1.2% |
| crypto24 | 1 | 1.2% |
| direwolf | 1 | 1.2% |
| securotrop | 1 | 1.2% |
Daily Event Flow — Last 10 Days
+38.3%
9Avg / day
Most attacked countries (10d)All countries
Sector Trends
Attack volume per sector
Recent Ransomware AttacksAll victims
| Date | Group | Victim | Country | Sector |
|---|---|---|---|---|
| 23 Sept 2026 | qilin | Inkript | Unknown | Other |
| 23 Sept 2026 | akira | Apex Litigation Support | Unknown | Legal Services |
| 23 Sept 2026 | silentransomgroup | Clark Hill | Unknown | Other |
| 23 Sept 2026 | akira | HIT dd | Unknown | Hospitality |
| 23 Sept 2026 | incransom | Lemon Law | United States | Legal Services |
| 23 Sept 2026 | akira | Urban Engineering | Unknown | Financial Services |
Most Attacked Sectors (10d)All sectors
| Other | 32 | 37.6% |
| Technology | 10 | 11.8% |
| Non-Profit | 8 | 9.4% |
| Financial Services | 5 | 5.9% |
| Construction | 4 | 4.7% |
| Education | 4 | 4.7% |
| Healthcare | 4 | 4.7% |
| Legal Services | 4 | 4.7% |
| Manufacturing | 4 | 4.7% |
| Government | 3 | 3.5% |
| Hospitality | 2 | 2.4% |
| Real Estate | 2 | 2.4% |
Cyber Threat Intelligence Updates
Curated intelligence updates are not available yet.
Key figures
This public tracker currently lists 6,229 claimed victim records, 21 groups active in the last 30 days, across 31 countries.
Last updated . Data is claimed-victim intelligence, not legal attribution. Cite invaders.ie/services/ransomware-tracker. Aggregate snapshot: JSON dataset.
About this trackerWhat this page is, how often it updates, how to cite
- What does the Invaders Ransomware Tracker show?
- It is a public intelligence surface that lists claimed ransomware victims, tracked groups, countries, and industries from Invaders threat data. It is not an authenticated product dashboard.
- How often is the ransomware tracker updated?
- The tracker refreshes from the live Strapi dataset. Each page shows a last-updated timestamp when a snapshot is available.
- How should I cite the Invaders Ransomware Tracker?
- Cite Invaders Cybersecurity and the canonical URL https://invaders.ie/services/ransomware-tracker. Aggregate KPI snapshots are published at https://invaders.ie/api/ransomware/v2/dataset.
- What is the difference between groups and victims pages?
- Groups pages summarize threat actors and their claimed volume. Victims pages list individual claimed attacks and can be browsed by country, industry, year, and month.