Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added

Ransomware groups listed 857 victims on their leak sites in September 2026, from 82 groups, in Brandefense’s Atlas data. That is 21 percent fewer than August, when the same count was 1,086. October has been faster: 941 victims in its first 26 days, or 36.2 a day against 28.6 in September.

This post reads the numbers month by month: how many, which groups, which weeks, which sectors and which countries. Every count of listings is Atlas data read on 27 October 2026. The last section says how we counted and where the data is weak.

How Many Victims Did Ransomware Groups List in September 2026?

September had 857 listings from 82 groups, about 28.6 a day. August was the high point of the 13 full months in the chart with 1,086 listings from 87 groups, or 35.0 a day. September 2025 had 528, so the latest full month is 62 percent above the same month a year earlier.

October is not in the chart because the month is not over. Its first 26 days (1 to 26 October) hold 941 listings from 80 groups. At 36.2 a day, October runs 27 percent above September’s daily pace and is close to August’s 35.0.

Which Ransomware Groups Listed the Most Victims?

One group alone, The Gentlemen, listed 105 victims, 12.3 percent of the month. Together with Qilin (75) and Akira (36, tied with Storm) the top three account for 216 listings, or 25 percent. The top ten groups account for 411, or 48 percent.

The chart lists the tie between Akira and Storm in alphabetical order. Behind the leaders sits a long tail: 48 of the 82 groups listed five or more victims, and 15 listed exactly one.

Qilin is a good example of why a few names dominate. MITRE ATT&CK describes it as ransomware as a service. The operators, tracked as Water Galura, handle payload creation, ransom talks and the publishing of stolen data for affiliates (MITRE group G1050). In our reading, many affiliates posting through one platform produce a large count.

SafePay listed 32 victims in September. On 20 October 2026 CISA and its partners published advisory AA26-293A, which says SafePay has been highly active since August 2024 and has at least 600 separate victims. We cover it in our SafePay advisory post.

Listings also arrive in batches. Clop listed 24 victims in September, and 22 of them appeared on one day, 23 September. A count for a month can therefore hide a single day.

Which Weeks Were the Busiest, and Which Groups Drove Them?

Weekly totals rose every week from 176 listings in the week of 7 September to 302 in the week of 12 October, the peak of the period. The week of 19 October fell back to 222. The table below shows the seven groups with the most listings across these seven full weeks, newest week first. Weekly totals count every group.

Storm and Emperador tie for seventh place with 40 listings each, and Storm is left out of the table.

The week of 12 October stands out because of N0n, a group whose earliest counted listing in Atlas is dated 18 September. It listed 38 victims on 12 October alone. By 26 October N0n had 128 listings in October, more than any other group. The weeks not shown are 1 to 6 September (133 listings in six days) and 26 October (84 listings in one day).

Which Days of the Week Do Leak Sites Fill Up?

In September, Monday to Wednesday brought 551 of the 857 listings (64 percent). Saturday and Sunday brought 101 (12 percent). October is flatter, with 167 of 941 on weekends (18 percent).

The busiest day from 1 September to 26 October was Monday 26 October with 84 listings. The Gentlemen posted 38 of them and Qilin posted 19. The next busiest days were 12 October (76) and 6 October (61).

Which Sectors Were Hit Hardest?

Manufacturing was the most listed sector in September with 114 victims, 13.3 percent of all listings. Technology (90), healthcare (85), consulting (83) and education and research (73) follow. Atlas gave no sector to 70 listings (8.2 percent), and they are left out of the chart.

The one big move in October is transportation and logistics: 71 listings in 26 days against 48 in all of September. Manufacturing (102), technology (94) and healthcare (92) kept their places. CISA’s Akira advisory names manufacturing, information technology and healthcare among the sectors that group favors. These counts cover all groups, so do not read them as an Akira statistic.

Where Are the Victims Based?

The United States accounts for 336 of the 857 September listings (39.2 percent) and 381 of the 941 October listings (40.5 percent). Germany is second with 32.

Türkiye had 18 listings in September and 17 in the first 26 days of October. The listing carries no country for 37 September victims (4.3 percent) and 65 October victims, so the true shares are slightly different. A country code in a leak-site listing is the group’s own description or Atlas’s reading of it, not a verified location.

Which New Groups Showed Up?

For 11 groups the earliest counted listing in Atlas is dated in September, and for 5 more it is dated from 1 to 26 October. The biggest September arrivals were N0n (18 victims, earliest listing dated 18 September) and Vexy-ransomware (18, earliest listing dated 2 September). In October the largest are Umbra (10) and Whitearmor (10).

N0n shows how fast a new name can grow. Its earliest counted listing in Atlas is dated 18 September. By the end of 26 October Atlas counted 146 listings for it.

We make no claim about who is behind it. Atlas data shows the listings and nothing else, and an earliest listing date is not the date a group started work.

What Should Defenders Take From This?

In our assessment, three things follow from the numbers. They are our reading, not a statement by the sources.

• Watch for your name and your suppliers’ names. Batches of 20 to 40 listings in a day mean a supplier or partner can appear on a leak site without any warning to you.
• Close the doors the advisories name. CISA says Akira actors get in through VPN services without multifactor authentication and through known flaws. For SafePay it lists stolen or guessed passwords and flaws in internet-exposed systems.
• Do not wait for the monthly average. October’s pace of 36.2 a day is 27 percent above September’s. A group that is new this month can be the largest next month.

Brandefense Threat Intelligence monitors ransomware leak sites, and our ransomware intelligence page explains how it works. For profiles of the groups in this post, see the ransomware groups library. Our earlier quarterly view is Top 5 Ransomware Groups in Q2 2026; the counts differ, see the next section.

How We Counted: Method and Limits

Atlas, Brandefense’s free external scan site, keeps a table of ransomware leak-site listings that is synced through the day. We read it once on 27 October 2026 (read-only, counts only). No victim names, domains or descriptions were selected, and none appear here.

• What is counted: listings with status confirmed, not deleted, and not a re-listing of a victim already counted. In September that leaves out 96 re-listings.
• Which day: the day the leak site published the listing, in UTC. October covers 1 to 26 October, the last complete day before the read.
• Sector and country: the first sector label and the country code Atlas holds for the listing. Listings without one are shown as unknown.
• Group names: as Atlas spells them. Our own pages may spell a name differently, for example Cl0p (Clop in Atlas).

Limits are real. A listing is the group’s claim, not a confirmed breach. Not every victim is listed, so the counts show leak-site activity and not every attack.

Rows for past days can still arrive, so these figures may move by a small amount. Atlas’s coverage of older months may be thinner than today’s, so treat the 13-month line with care.

Top 5 Ransomware Groups in Q2 2026 reported 2,509 victims for the quarter ending 3 July under a different cut. With the rule used here, Atlas gives 2,381 for the same dates. Do not mix the two series. Our Ransomware Trends Report for Q3 2026 uses its own method and dates, so its totals can differ from the September figures here.