Ransomware Tracker
Global Ransomware Dashboard
Livesynced just nowRequest assessment
Live ransomware intelligence
Global Ransomware Dashboard
2026-10-27 → 2026-11-02Tracking 54 groups7,283 victim records
Total Events
238
▼ 75.6% vs prior period
Active Groups
14
▼ 30.0% vs prior period
Data Leaks Posted
187
▼ 79.5% vs prior period
24h Change
-75.6%
▼ 75.6% vs prior window
Geographic Threat Heatmap
4,581Total attacks-75.6%
Loading map…
Daily Event Flow — Last 7 Days
-75.6%
10Avg / day
Most attacked countries (7d)All countries
| UNKNOWN | 40 | 55.6% |
| United States | 17 | 23.6% |
| Belgium | 3 | 4.2% |
| Germany | 2 | 2.8% |
| Philippines | 2 | 2.8% |
| Canada | 1 | 1.4% |
| Ivory Coast | 1 | 1.4% |
| United Kingdom | 1 | 1.4% |
| Hungary | 1 | 1.4% |
| Japan | 1 | 1.4% |
| Mexico | 1 | 1.4% |
| Malaysia | 1 | 1.4% |
Country Trends
Attack volume per country
Unknown
156▼ 79%
Sector Trends
Attack volume per sector
Recent Ransomware AttacksAll victims
| Date | Group | Victim | Country | Sector |
|---|---|---|---|---|
| 2 Nov 2026 | akira | Princeton Management | Unknown | Non-Profit |
| 2 Nov 2026 | akira | Howells Motor Freight | Unknown | Transportation |
| 2 Nov 2026 | akira | Usnext | Unknown | Technology |
| 2 Nov 2026 | qilin | Astino Berhad | Malaysia | Other |
| 1 Nov 2026 | qilin | qc-consult | Unknown | Other |
| 1 Nov 2026 | sarcoma | Ivan Smith Furniture | Unknown | Retail |
Most Attacked Sectors (7d)All sectors
| Other | 23 | 31.9% |
| Non-Profit | 10 | 13.9% |
| Healthcare | 7 | 9.7% |
| Education | 4 | 5.6% |
| Financial Services | 4 | 5.6% |
| Legal Services | 4 | 5.6% |
| Manufacturing | 3 | 4.2% |
| Real Estate | 3 | 4.2% |
| Technology | 3 | 4.2% |
| Transportation | 3 | 4.2% |
| Construction | 2 | 2.8% |
| Energy & Utilities | 2 | 2.8% |
Cyber Threat Intelligence Updates
Curated intelligence updates are not available yet.
Key figures
This public tracker currently lists 7,283 claimed victim records, 14 groups active in the last 30 days, across 26 countries.
Last updated . Data is claimed-victim intelligence, not legal attribution. Cite invaders.ie/services/ransomware-tracker. Aggregate snapshot: JSON dataset.
About this trackerWhat this page is, how often it updates, how to cite
- What does the Invaders Ransomware Tracker show?
- It is a public intelligence surface that lists claimed ransomware victims, tracked groups, countries, and industries from Invaders threat data. It is not an authenticated product dashboard.
- How often is the ransomware tracker updated?
- The tracker refreshes from the live Strapi dataset. Each page shows a last-updated timestamp when a snapshot is available.
- How should I cite the Invaders Ransomware Tracker?
- Cite Invaders Cybersecurity and the canonical URL https://invaders.ie/services/ransomware-tracker. Aggregate KPI snapshots are published at https://invaders.ie/api/ransomware/v2/dataset.
- What is the difference between groups and victims pages?
- Groups pages summarize threat actors and their claimed volume. Victims pages list individual claimed attacks and can be browsed by country, industry, year, and month.