Ransomware Tracker
Global Ransomware Dashboard
Livesynced 2m agoRequest assessment
Live ransomware intelligence
Global Ransomware Dashboard
2026-08-03 → 2026-09-01Tracking 47 groups5,926 victim records
Total Events
164
▼ 45.5% vs prior period
Top contributors · last 30dpeak 26
Active Groups
16
▲ 23.1% vs prior period
Data Leaks Posted
123
▼ 55.6% vs prior period
24h Change
-45.5%
▼ 45.5% vs prior window
Geographic Threat Heatmap
4,163Total attacks-45.5%
Loading map…
Most active groups (30d)All groups
| akira | 34 | 20.7% |
| incransom | 33 | 20.1% |
| qilin | 19 | 11.6% |
| play | 16 | 9.8% |
| dragonforce | 15 | 9.1% |
| safepay | 11 | 6.7% |
| rhysida | 8 | 4.9% |
| spacebears | 8 | 4.9% |
| silentransomgroup | 5 | 3.0% |
| interlock | 4 | 2.4% |
| lynx | 3 | 1.8% |
| beast | 2 | 1.2% |
Daily Event Flow — Last 30 Days
-45.5%
5Avg / day
Most attacked countries (30d)All countries
Sector Trends
Attack volume per sector
Recent Ransomware AttacksAll victims
| Date | Group | Victim | Country | Sector |
|---|---|---|---|---|
| 1 Sept 2026 | crypto24 | Me*** | Singapore | Other |
| 1 Sept 2026 | akira | BYK Construction | Unknown | Construction |
| 1 Sept 2026 | akira | Bihl | Unknown | Non-Profit |
| 1 Sept 2026 | akira | Davis & Ferber | Unknown | Legal Services |
| 1 Sept 2026 | akira | Flex1 | Unknown | Legal Services |
| 1 Sept 2026 | akira | Congressional Iron Works | Unknown | Construction |
Most Attacked Sectors (30d)All sectors
| Other | 28 | 17.1% |
| Technology | 23 | 14.0% |
| Financial Services | 19 | 11.6% |
| Healthcare | 15 | 9.1% |
| Manufacturing | 15 | 9.1% |
| Legal Services | 14 | 8.5% |
| Construction | 11 | 6.7% |
| Non-Profit | 11 | 6.7% |
| Education | 6 | 3.7% |
| Government | 6 | 3.7% |
| Energy & Utilities | 5 | 3.0% |
| Food & Beverage | 3 | 1.8% |
Cyber Threat Intelligence Updates
Curated intelligence updates are not available yet.
Key figures
This public tracker currently lists 5,926 claimed victim records, 16 groups active in the last 30 days, across 24 countries.
Last updated . Data is claimed-victim intelligence, not legal attribution. Cite invaders.ie/services/ransomware-tracker. Aggregate snapshot: JSON dataset.
About this trackerWhat this page is, how often it updates, how to cite
- What does the Invaders Ransomware Tracker show?
- It is a public intelligence surface that lists claimed ransomware victims, tracked groups, countries, and industries from Invaders threat data. It is not an authenticated product dashboard.
- How often is the ransomware tracker updated?
- The tracker refreshes from the live Strapi dataset. Each page shows a last-updated timestamp when a snapshot is available.
- How should I cite the Invaders Ransomware Tracker?
- Cite Invaders Cybersecurity and the canonical URL https://invaders.ie/services/ransomware-tracker. Aggregate KPI snapshots are published at https://invaders.ie/api/ransomware/v2/dataset.
- What is the difference between groups and victims pages?
- Groups pages summarize threat actors and their claimed volume. Victims pages list individual claimed attacks and can be browsed by country, industry, year, and month.