Ransomware activity

Countries named most in 2026

152 countries were named in January to October 2026. United States was named most, in 37.8% of claims.

Recent claims

The latest 50 organisations named by ransomware groups in 2026, newest first. The list covers 1 September 2026 to 18 October 2026.

What blunts these attacks

Eight practical steps that work for any business, anywhere. They follow the Australian Signals Directorate's Essential Eight, and line up with the protections in the NIST Cybersecurity Framework and the CIS Controls. None is a guarantee, but together they make an attack harder and a recovery easier.

1. Patch applications. Install security updates for the software your business runs, starting with anything that faces the internet.
2. Patch operating systems. Keep Windows, macOS, Linux and phone systems up to date so known holes are closed.
3. Multi-factor authentication. Ask for a second proof, such as an app code, so a stolen password alone is not enough to get in.
4. Restrict administrative privileges. Give admin powers to few people, only when needed, so one stolen account cannot change everything.
5. Application control. Allow only approved programs to run, so unknown software, including ransomware, is blocked.
6. Restrict Microsoft Office macros. Block macros from files that came from the internet, because a booby-trapped document is a common way in.
7. User application hardening. Switch off risky features in browsers and office programs that attackers like to abuse, and block what you do not need.
8. Regular backups. Keep copies of important data that are kept offline or cannot be changed, and test that you can restore them.

About this data

• Counts are claims that criminal groups publish about themselves, collected by a public aggregator. They can be wrong, duplicated or late, and not every victim is listed.
• Source: public claim counts collected by ransomware.live. As at 18 October 2026.
• We never visit leak sites. We show each organisation name and website as the aggregator published them, and never stolen data, links to claims or screenshots.