• Ransomware
• Threat Intelligence
• Dark Web Monitoring
• Cybersecurity Trends

Ransomware Attacks in October 2026: Monthly Report

Josh Amishav · Last updated Nov 1, 2026 · 6 min read

Quick Summary

Ransomware groups listed 953 companies on their leak sites in October 2026, for a 2026 total of 7,807 victims. The total for all of 2025 was 7,307 victims. If a supplier is hit, the leak-site post usually won’t mention your company, even when the stolen files include your data. Search the leaked files themselves for your company’s data and your clients'.

Why watching leak sites for your own name misses supplier breaches

In October, 46 ransomware victims were law firms, up from 34 in September. A company that watches leak sites only for its own name gets no alert when its law firm is listed. The stolen files can still include the company’s contracts.

Why listen to us?

Breachsense is a dark web monitoring API that tracks ransomware leak sites and indexes the files published on them. We publish a page for each ransomware victim we track. ClassAction.org has cited those pages in its breach investigations. Kaspersky’s ICS CERT has cited our ransomware victim records in its quarterly industrial cybersecurity reports. TechTarget has cited our annual ransomware report. See who else cites our data.

October 2026 ransomware numbers at a glance

• 953 victim companies claimed across ransomware leak sites
• 81 active ransomware groups (up from 79 in September)
• 76 countries affected (down from 88)
• 66 industries represented (up from 59)
• 21% increase from September’s 789 victims
• 56% above the 2025 monthly average of 609 victims

TheGentlemen was the most active ransomware group in October

October’s victim count was 164 higher than September’s. Between them, TheGentlemen, Qilin and n0n listed 140 more victims than they did in September.

TheGentlemen claimed 135 victims, its highest count in any month. Its previous high was 127 victims, in August. It has claimed the most victims in four of the last five months, counting July’s tie with Qilin.

n0n went from 10 victims to 78. n0n listed its first victims in late September.

Booba’s victim count rose from 7 to 29. Booba listed its first victims in June. Booba stayed under 10 victims a month until October.

NightSpire’s victim count rose from 8 to 23. NightSpire hadn’t been in the top 10 since March. Everest’s victim count also rose to 23, from 10.

INC_RANSOM’s victim count fell to 26, its lowest of 2026. KRYBIT’s count dropped from 35 to 11, out of the top 10. Storm’s count went from 33 to 17.

US companies made up 43% of ransomware victims in October

Ransomware groups listed 408 US companies, up from 321. The US share rose from 41%.

Groups listed 54 German companies, the most this year, up from 25 in September. The previous high was 48, in July. Groups have listed 355 German companies in 2026, against 274 in all of 2025.

Victim counts for Spain (28) and Brazil (27) were also the highest this year.

Mexican companies were back in the top 10 with 18 victims, up from 7. Mexico hadn’t been in the top 10 since May.

Ransomware groups listed more healthcare companies than any other industry in October

Groups listed 117 healthcare companies, the most for any industry in a single month this year. Healthcare ranked first for the fifth month in a row. Groups have listed 720 healthcare companies in 2026, more than the 538 in all of 2025.

The logistics victim count went from 8 to 34, its highest of 2026.

The education victim count rose to 45, the highest this year for the second month in a row. The manufacturing victim count rose to 72, the highest since March.

The IT victim count fell from 53 to 26, out of the top 10. Transportation also dropped out of the top 10, with 27 victims.

Ransomware victims in 2026 already outnumber 2025’s total

Qilin has claimed 1,078 victims so far in 2026, more than any other group. In all of 2025, Qilin claimed 958 victims. TheGentlemen is second with 908 victims this year, after claiming only 72 victims in all of 2025. Akira is third with 445 victims, compared with 735 in 2025.

What security teams should do

Search the files ransomware groups leak for your company’s data and your clients’. Look for terms that identify your data, such as your domain or a client’s name. You can search the text of leaked files yourself, or add those terms to a Breachsense watchlist to get an alert. When a watchlist term appears in a leaked file we’ve indexed, we send an alert with the file’s URL. If the file goes offline, you can download its text from our backup.

How we collected this data

We count each company a ransomware group lists on its leak site as one claimed victim. Companies that pay before a group lists them don’t appear in these numbers.

When several groups claim the same company, it counts once in the total and once under each group that claimed it. Industry and country are based on the company’s primary business and headquarters.

Find out if a supplier’s leak included your data

Our dark web monitoring indexes the files ransomware groups publish, so you can find your company’s data in a supplier’s leak.

Breachsense is a dark web monitoring API for security teams and MSSPs. It finds credentials and session tokens that have already been stolen from your staff or customers, whether by infostealer malware or a phishing page. It sends those credentials and tokens by webhook, so teams can reset the affected accounts before attackers use them. It also indexes the files ransomware groups leak, so you can search them for your own company’s data.

To see which of your employees’ credentials have already leaked, run a free dark web scan. To get alerts when your data shows up in leaked files, book a demo.

Our October 2026 phishing report and October 2026 infostealer report cover stolen credentials. For the previous month’s ransomware numbers, see the September 2026 ransomware report.