Fifty victims in a day, two hosting breaches and town halls offline

Between 26 October and 4 November 2026, ransomware groups named 411 organisations on their leak sites: 41.1 a day, up from 34.9 in the ten days before and from 36 a day in the month our October round-up covered. 52 groups posted at least one victim, in 51 countries. The busiest day was 31 October, with 84 new names, 50 of them from a single group.

A leak-site post is a claim by a criminal group, not a confirmed breach. Groups post victims to pressure them into paying, and some claims are exaggerated, recycled or false; many attacks are never posted at all. So we read the claims next to what victims and the press reported, and this article does the same. The figures come from Ransomware.live, which tracks the leak sites; the latest claims are on our ransomware page.

The attackers

The Gentlemen: 50 names in one day

The Gentlemen posted all 50 of its victims in our window on a single day, 31 October, which makes it the busiest group of the ten days. One of them, Epichealth, which runs four medical clinics in Victoria, Australia, has confirmed that "an unauthorised third party accessed part of our IT systems" and that patient contact details, Medicare numbers and health information were involved (Cyber Daily). On 5 November the group also listed the health department of the Brazilian state of Mato Grosso, which had already said that an attack on 1 November forced it to suspend systems while emergency care carried on (CNN Brasil). In Coveware's report on the third quarter, The Gentlemen shared first place with lone attackers, each behind 6% of the cases the firm handled, in a field it describes as very fragmented (Coveware via Veeam).

Qilin steady, n0n quieter and exposed

Qilin named 47 victims, up from 41 in the ten days before, as steady as ever. n0n, which topped October with a batch of 38 port and shipping firms, fell to 24, and 21 of those were posted only as "Company #" placeholders without a name. On 28 October SOCRadar described a staging server the group had left open: 1,719 files, including the source code of its encryptor and the set-up of an open-source AI coding agent with more than 150 model configurations, some with their safety controls removed. SOCRadar's verdict is that a person directed the operation and AI helped, not that it ran by itself. It found no exploited vulnerabilities: the group got in by trying stolen passwords against 305 FortiGate VPNs and weak passwords for remote desktop, and by using cloud keys left exposed. None of the 55 Bitcoin addresses it checked had received a payment (SOCRadar).

Town halls, law firms and a returning name

Booba Project went from 6 victims to 21, 17 of them local governments, a police department, schools, education bodies and healthcare providers, most of them in the US. Silent Ransom Group named 16 victims, including several large US law firms. That fits the warning the FBI issued in May 2025: the group calls staff pretending to be IT support, and has sometimes sent someone to the office in person to plug in a storage device (FBI). Coveware used a leak of the group's own negotiation chats in October to argue that paying for silence does not work (Coveware).

MedusaLocker, a ransomware family that has been around since 2019, posted 18 victims on 4 November after none in the previous four weeks. Ten groups posted victims in our window that had posted none since 6 October, among them Genesis (10, mostly US professional services firms) and Shiba. Shiba has claimed the attack on the school district of Oneonta, New York, which closed for two days in October; its superintendent confirmed the district was "dealing directly with Shiba" (GovTech).

BYOD and Emperador: claims, some confirmed

BYOD, a group that first appeared this autumn, claimed the University of New Mexico on 26 October, the day UNM's Health Sciences Center diverted ambulances for two hours and cancelled operations and appointments. UNM confirmed the disruption but says the attack affected some end-user devices, not its core systems, and that it "did not make concessions with any group"; BYOD's claim of 36,000 compromised systems is unverified (UNM, BleepingComputer). It went on to claim Michigan State University, which links the claim to a password compromise in early October and has reset passwords across campus (The Record), and IHG Hotels & Resorts, which has not commented. Emperador claimed the Swiss building materials group Holcim on 31 October. Holcim confirmed that data was taken in "limited, unauthorised access" but says its plants, logistics and industrial control systems were not affected (Inside IT).

The victims

The United States had 146 of the 411 claims, 36%, as in most months. Germany (26), the United Kingdom (16) and Mexico (11) follow. By sector, manufacturing leads with 54, then professional services such as law and accountancy firms (50), technology (42) and healthcare (36). As usual, most of the names are small and mid-sized organisations.

What made the news

Some of the most disruptive attacks of the ten days never appeared on a leak site, at least not yet.

Two Japanese hosting companies, two lessons

GMO Internet, which runs the Onamae.com Desktop Cloud service, refused an extortion demand, after which the attackers published customer data on 27 October; up to 26,739 servers may be affected, and GMO is replacing customer PCs that ransomware reached (GMO Internet, TechNode Global). At a press conference on 2 November GMO said the intruders got in through a customer's virtual server in August and reached a management server, and that weaknesses its own security unit had flagged in 2024 never reached top management (@IT). Reports of the ransom amount vary widely, so we leave it out. IDC Frontier, whose IDCF Cloud outage hit 495 customers in October, closed its investigation on 27 October: the attackers used a flaw in an open-source component of its customer portal's login system to get administrator rights on the virtualisation platform, then encrypted customers' virtual machines. Nikkei xTECH reports that a fixed version of that component had been available for weeks (IDC Frontier, Nikkei xTECH).

Hospitals and care homes

• University Hospitals in Cleveland, Ohio, cut itself off from the internet after finding unusual activity on 22 October and was still largely offline on 2 November; its hospitals and emergency departments stayed open. It has not said what kind of attack it was (Ideastream, HIPAA Journal).
• A residential care home in Rovereto, Italy, was hit on 28 October and received a ransom demand, a month after a similar attack on another care home in the same province (ANSA).
• WS Audiology, the Danish maker of Widex and Signia hearing aids, took apps and cloud services offline after "unauthorized parties accessed parts of its IT infrastructure"; the hearing aids themselves were not affected (Cyber Security News).

European town halls, charities and a university

• The city council of La Laguna on Tenerife lost its website, online services and tax and accounting systems from 2 November. Local media report a ransom demand of five million in bitcoin, which the council refused; it reported the attack to Spain's national cryptologic centre and extended administrative deadlines (Atlántico Hoy).
• Santa Perpètua de Mogoda near Barcelona confirmed a ransomware attack on one server of its communication department (Ajuntament).
• In Germany, the Protestant regional association of Frankfurt and Offenbach found server files encrypted on 27 October (EFO-Magazin), the welfare organisation AWO Ruhr-Lippe-Ems said files were copied from a server, possibly including care and counselling records (AWO), and the district of Oberspreewald-Lausitz, which we covered in October, still could not work digitally on 31 October (Nordkurier). Leipzig University took all its IT offline on 28 October and expects weeks of disruption; it has not said what kind of attack it was (t-online).
• WallStreet listed Bristol City Council on 27 October without evidence; the council has not linked any incident to the group (Cypro).

The bill for October

Ahold Delhaize, whose October attack took websites and apps offline in the US and Europe, now expects it to cost €200 to 250 million in fourth-quarter sales and €75 to 100 million in operating income (Ahold Delhaize). Separately, it was one of several supermarket chains whose refrigeration systems were tampered with remotely in more than 115 stores across Europe; that is not ransomware, and no group has claimed it (BleepingComputer). BAE Systems says no data was taken in the incident that stopped US bankruptcy court notices for more than two weeks; the service was back on 26 October (SecurityWeek).

How they got in

• Old flaws on network storage. Synology warned that the C3RB3R ransomware is attacking its NAS devices through a flaw it fixed in December 2024 (BleepingComputer). If a NAS can be reached from the internet, update it or take it off.
• Fake IT support in Microsoft Teams. Arctic Wolf counted more than 400 incidents that start with a flood of spam, then a Teams chat from "IT Support", then a remote-access tool; the attackers run their payload within 15 minutes (Infosecurity Magazine). Block Teams chats from outside your organisation unless you need them.
• Backups first. In an attack on a UK school trust by an affiliate of the 3AM group, the attacker took the passwords of three Veeam backup servers before encrypting 37 machines. Bitdefender saw repeated, slightly varied commands that looked like an automated AI loop, though that is not proven (BleepingComputer).
• Mostly people and passwords. In Coveware's third-quarter cases, phishing and social engineering accounted for about 29% of break-ins, compromised remote access for about 22%, stolen credentials for about 14% and unpatched edge devices for about 11%. Nearly 80% of its cases ended without a payment (Coveware via Veeam).

In court, a Ukrainian affiliate of the Nefilim and Hive operations was sentenced in the US to 70 months in prison on 27 October, and the State Department offers up to $11 million for information on his alleged accomplice (The Record).

What to take from it

• Patch the boring things. The two Japanese hosting breaches started with a component with a known fix and with warnings that were never acted on. Synology's attackers use a flaw almost two years old. Our exploited list shows what attackers are using now, and our patch post covers this fortnight's additions.
• Protect remote access with more than a password. n0n got in by trying stolen passwords against VPNs. Use phishing-resistant MFA on VPNs and remote desktop, and watch for many failed logins.
• Train staff for the phone call and the Teams chat. Silent Ransom Group and the Teams campaigns both rely on someone posing as IT support. Make it easy to check whether a request really comes from your IT team.
• Keep backups the attacker can't reach. Backup servers are an early target. Keep an offline or immutable copy and test restoring it.
• Don't take a claim at face value, either way. If your name, or a supplier's, appears on a leak site, check what actually happened before you react. Our ransomware page lists new claims every two hours.

About the data

The figures cover victims first seen on a leak site between 26 October and 4 November 2026, from Ransomware.live, which collects the posts from the groups' sites. We count each posted victim once. The figures are claims made by criminals: neither Cyfenced nor Ransomware.live has verified them, and a listing does not prove that an organisation was breached. We name a claimed organisation only where it, or the press, has reported an incident. We don't link to the groups' sites or repeat what they say they stole. If your organisation is listed in error, contact Ransomware.live support. Press reports are linked where we cite them; where outlets disagreed on a detail, we have left it out.