Ransomware Leak Sites Report 30% Rise in Claimed Victims
Original title: Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake
New unproven groups drove most growth in named victims with some claims likely false.
The number of organizations named on ransomware leak sites increased 30% in Q3 2026. Analysts at ReliaQuest attribute most growth to 43 new groups that had not posted previously. Established groups added only 1% more. Many new postings use bulk releases or recycled data and may not reflect real breaches.
Unconfirmed: Some claimed breaches may be false allegations or rebrands
- 43 new groups drove 93% of the increase
- ExfilSquad used GitHub credentials for limited data access
- Manufacturing victims rose 70% in listed claims
- US share of victims fell to 41%
Impact: unverified claims of data breaches
- 1.Review internal logs and access records
- 2.Check for GitHub credential exposures
- 3.Audit for Group Policy changes
- Threat actors
- Global Secret Groupcrpx0StormExfilSquadOrova
- Organizations
- ReliaQuest
- Countries
- United States
From the original article
4 min read at cybersecuritynews.com
The number of organizations named on ransomware leak sites rose 30% in the third quarter of 2026. Researchers say that does not mean attacks rose by the same amount. Most of the growth came from new, unproven groups, and some of their claims may be false.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.