Ports, a cloud host and a busy month for extortion

Between 25 September and 25 October 2026, ransomware groups named 1,082 organisations on their leak sites. That is about 36 a day. In the whole of September they named 846; by 25 October, October had already passed that with 892. The busiest single day was 9 October, with 82 new names.

A leak-site post is a claim by a criminal group, not a confirmed breach. Groups post victims to pressure them into paying, and some claims are exaggerated, recycled from older leaks or simply false. The claims also miss a lot: many victims pay, or are never posted. So we read this data next to what victims and the press reported, and this article does the same. The numbers come from Ransomware.live, which tracks the leak sites; you can see the latest claims on our ransomware page.

The attackers

n0n: top of the table, from one supplier

The busiest group of the month was n0n, with 148 victims in our window. Its first post of September came on the 18th; it named 18 victims that month and 144 in the first 25 days of October. Most of them came in one burst: on 12 October it put 38 port, terminal, shipping and logistics companies in 18 countries on its site within 23 minutes, all with the same deadline of 19 October. Twelve were in South Korea (SOCRadar, The Loadstar).

Maritime security firm Cydome assessed that the data is likely from CyberLogitec, a Korean company that makes software for ports and shipping lines, and other analysts think it may be a single support archive rather than 38 separate break-ins (Hellenic Shipping News, IndexBox). None of the 38 had confirmed a compromise by mid-October. It also explains why transportation has 73 victims this month: 35 of them came from that one batch.

The Gentlemen: still near the top after its own leak

The Gentlemen was the busiest group in September, with 105 victims, and named 138 in our window, 37 of them on 9 October alone. It mostly hits manufacturers and healthcare, and a third of its victims are in the United States. It runs ransomware as a service: affiliates do the break-ins and keep 90% of the ransom, an unusually generous split. Its main way in has been Fortinet VPNs, alongside Cisco edge devices and NTLM relay attacks (Halcyon, Bitsight). In May its own back end was breached and its chat logs, affiliate list and negotiation transcripts leaked; it rebuilt and carried on (Blackpoint Cyber).

Qilin and INC: a patched VPN flaw, still paying off

Qilin named 100 victims, as steady as ever. In updates on 19 and 20 October, Palo Alto Networks' Unit 42 said Qilin and INC Ransom (31 victims) are breaking in through CVE-2026-0257, a flaw in GlobalProtect that, on gateways set up in a certain way, lets an attacker open a VPN session without logging in, and so get past MFA. Palo Alto fixed it in May and it is on CISA's list of exploited vulnerabilities, but unpatched gateways are still being found. Once inside, the attackers use remote-management tools to look around and move on over RDP and SMB (The Hacker News, Cybersecurity Dive). The Settra group, with 17 victims this month, has been tied to the same flaw.

Several Qilin claims match attacks that were reported in the press: the water utility of Ciudad Victoria in Mexico (COMAPA Victoria), the government of Heber City, Utah, and Corby Rock Mill in Ireland, where production was hit.

And 78 more

Behind the top three, the field is wide. NightSpire went from 8 victims in September to 33. Akira and INC Ransom named 31 each. SafePay (25) is unusual in hitting Switzerland and Germany more than the US; it also claimed the Holiday Inn in Vilnius, where, Lithuanian media reported, data on 500 guests was published after no ransom was paid. Majinahanashi first appeared on 10 October, with 19 victims that day, mostly restaurants, shops and hotels. In all, 24 groups posted victims in our window that had posted none from 1 to 25 September.

Other claims that match press reports: BYOD, which first posted on 5 October, claimed Trump Mobile, whose customer information hackers released, according to press reports; WallStreet claimed Green Clinic in Louisiana, where care was disrupted; Chaos claimed healthcare company Astrana, which reported a breach to the SEC; and Eclipse claimed The Japan Times.

The victims

The United States had 373 of the 1,082 claims, about a third, as it does most months. Germany (49), the United Kingdom and Brazil (38 each) and Canada (26) follow. By sector, manufacturing leads with 166, then professional services such as law and accountancy firms (120), healthcare (119) and technology (113). Most of the names are small and mid-sized organisations, not household names.

What made the news

Some of the month's most disruptive attacks never appeared on a leak site, at least not yet. These are the ones that stood out in press reports.

A cloud outage that hit 495 customers at once

On 7 October, ransomware stopped the virtual servers in four zones of IDCF Cloud, run by SoftBank's IDC Frontier in Japan. The company said 495 companies and local governments were affected; the websites of Ibaraki Prefecture and its police went offline, and JR East was among the first customers to confirm it was hit. Customers were told to rebuild from their own backups, because data in the affected zones was unlikely to be recovered. On 14 October IDC Frontier said it had found no evidence that data had been viewed or taken (Cybernews, MLex).

A university that lost its backups too

At Osaka Metropolitan University, a suspected ransomware attack in early October stopped about 500 servers, and much of the backup data was encrypted as well. All classes were cancelled for days, and the university warned that data on up to 130,000 students and staff may have leaked (Jiji Press via Nippon.com, The Record).

Retail, courts and recruiters

• Ahold Delhaize took websites and apps offline across the US and Europe from 12 October, including Stop & Shop, Food Lion, Albert Heijn, Delhaize and bol.com. Stores stayed open, and the company said it had seen no sign that customer data was stolen. It was the company's second major attack in two years, after a ransomware attack in November 2024 (BleepingComputer, NL Times).
• US bankruptcy courts have been unable to send official notices since 9 October, after a security incident at BAE Systems Inc., the contractor that runs the Bankruptcy Noticing Center. Courts are adjourning creditor meetings and extending deadlines (BleepingComputer, Hackread).
• Bullhorn, whose staffing and recruitment software has more than 10,000 customers, took its platform offline around 17 October to contain an attack, brought in CrowdStrike and Kroll, and told customers to reset passwords and change API passwords (BleepingComputer, Staffing Industry Analysts).
• Quest Diagnostics, the US lab company, said on 22 October that a cyberattack had affected patient records (Reuters).

Town halls, schools and hospitals

As in most months, the public sector took many of the hits. In the US, Vicksburg in Mississippi shut down its computers after a ransomware attack, Bernalillo in New Mexico closed its motor vehicle office, and Heber City in Utah, Columbia in South Carolina and counties in Nebraska, Texas and elsewhere lost phones, payments or online services. Schools in Oneonta (New York) closed for two days and Jerome (Idaho) cancelled classes; Richmond Public Schools in Virginia cut internet access. In Germany, the district administration of Oberspreewald-Lausitz was largely paralysed by a suspected attack and the town of Eichstätt's administration went down. In Tangerhütte, the developer of the town's online services suspects that an AI system, not a person, found and used an unknown flaw; that has not been confirmed (Kommunal). Romania's central securities depository said national ID numbers and bank account numbers were accessed. Hospitals in Kassel, Indiana and Ohio, and a GP surgery's dispensary in Suffolk, all reported disruption.

More of these reports, updated every two hours, are on our news page.

What to take from it

• Check your VPN and other edge devices first. Two of the busiest groups are getting in through a Palo Alto flaw that was fixed in May, and a third through Fortinet VPNs. Patching closes the door but doesn't remove someone already inside, so also look for VPN sessions and remote-management tools you can't explain. MFA does not help against a flaw that skips the login. Our exploited list shows what attackers are using now.
• Know what your suppliers hold and run. Several of the month's biggest events came through suppliers: a port software company, a cloud host, a court contractor and a recruitment platform. Ask which of your data sits in a supplier's support systems, and plan for the day one of them goes offline.
• Keep backups the attacker can't reach, and test them. In Osaka the backups were encrypted along with everything else. IDCF customers had to rebuild from copies they kept themselves.
• Don't take a claim at face value, either way. If your name, or a supplier's, appears on a leak site, check what actually happened before you react. Our ransomware page lists new claims every two hours.

About the data

The figures cover victims first seen on a leak site between 25 September and 25 October 2026, from Ransomware.live, which collects the posts from the groups' sites. We count each posted victim once. The figures are claims made by criminals: neither Cyfenced nor Ransomware.live has verified them, and a listing does not prove that an organisation was breached. We don't link to the groups' sites or repeat what they say they stole. If your organisation is listed in error, contact Ransomware.live support. Press reports are linked where we cite them; where outlets disagreed on a detail, we have left it out.