Cyber Insights
Live Feed

Ransomware & Cyberattack Threat Intel

Real-world ransomware activity, tracked and updated continuously — presented here so the scale of the threat is something you can see, not just read about.

Viewing
Hour Day Week Month
All-Time Tracked
32,147 victims across 403 tracked groups
Last 24 Hours
43 attacks disclosed
Data refreshed hourly — last pulled Sep 28, 2026 7:30pm UTC
By Group

Top 10 ransomware groups

safepay 9
threeam 7
medusalocker 4
incransom 3
emperador 3
qilin 3
Panzer 3
Doommageddon 2
play 2
akira 2
Show full group ranking (15)
#1 safepay 9
#2 threeam 7
#3 medusalocker 4
#4 incransom 3
#5 emperador 3
#6 qilin 3
#7 Panzer 3
#8 Doommageddon 2
#9 play 2
#10 akira 2
#11 payload 1
#12 interlock 1
#13 SilentRansomGroup 1
#14 pear 1
#15 N0n 1
Distribution

Group share of attacks

safepaythreeammedusalockerincransomemperadorqilinPanzerDoommageddonOther
43attacks
safepay20.9%
threeam16.3%
medusalocker9.3%
incransom7%
emperador7%
qilin7%
Panzer7%
Doommageddon4.7%
Other20.9%
By Sector

Top 10 sectors

Manufacturing 8
Healthcare 6
Technology 5
Retail & E-Commerce 4
Professional Services 4
Not Found 3
Other 3
Government & Defense 2
Agriculture and Food Production 2
Hospitality 2
Recent Activity

Most recently disclosed attacks in this range

Organization Sector / Country Group Discovered
bakemyday.se Retail & E-Commerce · SE incransom Sep 28, 2026 7:30pm UTC
safescaffolding.net Manufacturing · GB threeam Sep 28, 2026 6:53pm UTC
coosalud.com Healthcare · CO threeam Sep 28, 2026 6:52pm UTC
pistonespersan.com.ar Manufacturing · AR threeam Sep 28, 2026 6:52pm UTC
midwestbit.com Technology · US threeam Sep 28, 2026 6:51pm UTC
apexus.com Technology · US threeam Sep 28, 2026 6:50pm UTC
bhn-expertise.com Professional Services · DE threeam Sep 28, 2026 6:50pm UTC
stjames.wa.edu.au Education · AU threeam Sep 28, 2026 6:49pm UTC
Goodrich Logistics Transportation · Doommageddon Sep 28, 2026 6:46pm UTC
Chem Process Systems Pvt. Ltd. Manufacturing · IN Doommageddon Sep 28, 2026 6:46pm UTC

This data reflects publicly disclosed ransomware activity. Cyber Insights presents it purely for public awareness — to make the scale and pace of ransomware activity tangible, not to sell any product or service.

Data source: Ransomware.live