March 31, 2026
Lock, shock, and hot takes
7,655 Ransomware Claims in One Year: Group, Sector, and Country Breakdown
Commenters cry data spin, point to a late-2025 surge, and slam industry silence
TLDR: Ransomware gangs posted 7,655 victim claims in a year, with Qilin leading and big hits on manufacturing and tech. Commenters feud over data spin, spotlight a late‑2025 surge, roast US‑centric framing, and blast industry “helplessness,” warning the attack pace—and the blame game—are both accelerating.
7,655 ransomware victim claims in a year—about one every 71 minutes—has the comment section doing math, making memes, and picking fights. The headline stat: Qilin tops the chart with 1,179 claims across 74 countries, while the top five groups together own 40% of the tally. But the crowd isn’t buying tidy narratives. One skeptic side-eyes the “fragmentation after the top five” line and fires the zinger: “Is this LLM analysis?” Another camp says the real story isn’t the leaderboard at all, it’s the “40% surge in the second half”—a claimed jump around September 2025 that suggests the ransomware machine got faster, not just bigger.
Geography drama? Oh, plenty. The article notes the U.S. at 40% of targets and “subsidiaries” elsewhere, and a commenter claps back with a global eye-roll: are Europe, Asia, and Latin America just branch offices now? Meanwhile, a sharp watcher flags SafePay’s 72 hits on Germany as a potential language- or tooling-driven play—cue the theories. Sector-wise, Manufacturing (890) and Technology (843) are the biggest punching bags, spawning gallows humor like “factory floors are the new dance floors for malware.”
The hottest take lands hardest: despite endless cyber alliances, “we act helpless against ransomware.” Meme of the day? “It’s ransomware o’clock—every 71 minutes.” Winners: the snark, the stat-nerds, and anyone who loves a good chart fight. Losers: your backup strategy.
Key Points
- •7,655 ransomware victim claims were posted to public leak sites from March 2025 to March 2026 by 129 groups across 141 countries, averaging ~20 per day.
- •The top five groups (Qilin, Akira, INC Ransom, Play, Safepay) accounted for 3,027 claims (40%), led by Qilin with 1,179 claims across 74 countries.
- •Play showed the strongest US concentration among the top five (64% of its 386 claims), while Qilin’s targeting was broadly distributed; Akira recorded 403 US claims.
- •Sector data was available for 4,970 claims; Manufacturing (890) and Technology (843) were the most targeted sectors, with Healthcare at 537.
- •A sizable long tail exists: 124 other groups posted 4,628 claims, indicating that disrupting a single group is unlikely to significantly reduce overall claim volume.