# Ransomware monitoring | Precursor Intelligence

**See which ransomware gangs are hitting your sector. From their own leak sites.**

> Ransomware monitoring tracks the gangs that publish their victims on leak sites, and every organisation they claim, by sector and country. You see which gangs are active, who they are naming in your sector and each group's full profile. It is for any business that wants to know how ransomware is hitting its peers.

Canonical page: https://www.precursorintelligence.com/features/ransomware-monitoring
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Ransomware monitoring
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Over 400 groups tracked. Over 30,000 claims recorded. By sector and country.

Figures on this page are real, from mid-October 2026. Example victim names use the reserved `.example` domain and are fictional; the example company is Acme.

## Contents

1. [What does the tracker show?](#what-does-the-tracker-show)
2. [How does it work?](#how-does-it-work)
3. [Who is hitting your sector?](#who-is-hitting-your-sector)
4. [Who have they claimed?](#who-have-they-claimed)
5. [Questions](#questions)
6. [Related features](#related-features)

## At a glance (mid-October 2026)

- 408 ransomware groups tracked and 30,455 victim claims recorded.
- 825 claims in the last 30 days, from 76 active groups.
- Most active groups over those 30 days: Qilin (86 claims), N0n (79), The Gentlemen (74), Akira (39), SafePay (32), INC Ransom (30).

## What does the tracker show?

Ransomware gangs name the organisations they say they have hit, to pressure them into paying. We record those claims so you can see the pattern, not just the headlines.

1. **Ransomware groups.** Over 400 groups tracked, of which 76 posted claims in the 30 days to mid-October 2026.
2. **Claimed victims.** Over 30,000 organisations named on leak sites, each recorded as a claim.
3. **By sector.** Which industries the gangs are naming most, from manufacturing to healthcare.
4. **By country.** Where the claimed victims are based, so you can look at the UK or anywhere else.
5. **Most active groups.** The gangs posting the most claims recently, at a glance.
6. **Relevant to you.** The claims and gangs in the sectors you have told us you work in.
7. **Group profiles.** How each group works, the flaws it uses and the sectors it goes after. See [threat intelligence](https://www.precursorintelligence.com/features/threat-intelligence).
8. **Public industry pages.** 15 industry pages, no account needed, listing the threat groups linked to each. [Browse industries](https://www.precursorintelligence.com/industries).

## How does it work?

There is nothing to install and nothing to connect. The tracker is built from what the gangs publish about themselves.

1. **A gang names a victim (on a leak site).** Ransomware groups publish the organisations they claim to have hit, usually to pressure them into paying.
2. **We record the claim (in the tracker).** Each claim is recorded against the group that posted it, with the organisation's sector and country.
3. **You filter and compare (whenever you look).** See the most active groups, or filter every claim by group, sector and country.
4. **Your sectors, first (on your dashboard).** Pick the sectors you work in and the gangs naming businesses like yours sit on your dashboard.

## Who is hitting your sector?

**By sector.** Each sector has its own most active gangs, and they change. Choose the sectors you work in and your dashboard shows the claims among your peers and the groups behind them.

- Claims in your sectors, and how many groups are behind them.
- The gangs most active against businesses like yours, so you know which names to read up on.
- Every sector and country, not just your own, when you want the wider picture.

Claims by sector, last 30 days to mid-October 2026:

| Sector | Claims | Most active groups |
|---|---|---|
| Manufacturing | 127 | Qilin 19, The Gentlemen 12, Akira 10, Emperador 7, Lamashtu 5 |
| Healthcare | 88 | The Gentlemen 11, N0n 7, Wallstreet 6, Storm 6, Booba Project 6 |
| Retail | 51 | The Gentlemen 8, SafePay 6, INC Ransom 4, Qilin 4, N0n 3 |
| Financial services | 34 | Storm 8, N0n 6, Qilin 5, BrainCipher 2, LockBit5 2 |

Browsing without an account? Our public [industry pages](https://www.precursorintelligence.com/industries) list the threat groups linked to each of 15 industry groups.

## Who have they claimed?

**Claimed victims.** Every claim we record sits in one searchable list. Narrow it to a group, a sector or a country and see who has been named, and when.

- Filter by group, sector and country to see the claims that matter to you.
- Open the group behind a claim to see how it works and which flaws it uses.
- Claims, not confirmed breaches. A gang posting a name is a strong signal, but it is the gang's word.

Group profiles, techniques and the flaws each gang uses live in [threat intelligence](https://www.precursorintelligence.com/features/threat-intelligence).

## Questions

### What is a ransomware leak site?

A website run by a ransomware gang where it names the organisations it claims to have attacked, often with a threat to publish stolen data, to pressure them into paying.

### Is every claim a confirmed attack?

No. A claim is what the gang has posted on its own site. We record it as a claim, so treat it as a strong signal rather than proof of what happened.

### How many groups do you track?

Over 400 ransomware groups and over 30,000 victim claims. In the 30 days to mid-October 2026, 76 groups posted 825 claims.

### Can I see just my own sector?

Yes. Pick the sectors you work in and your dashboard shows the ransomware claims and gangs in those sectors. You can still filter every claim by group, sector and country.

### Will you alert me if my company is named?

No. The tracker is something you browse. Our alerts cover flaws in the software you track, lookalike domains, certificates and dependency files, not ransomware claims.

### Do I need an account?

To see your own sectors, yes. Without one, you can still browse our public threat group and industry pages.

## Related features

- [Threat intelligence](https://www.precursorintelligence.com/features/threat-intelligence): who targets businesses like yours, how they work and which flaws they use.
- [Attack surface management](https://www.precursorintelligence.com/features/attack-surface-management): map everything of yours that anyone online can reach, and see what changed since your last scan.
- [Risk-based prioritisation](https://www.precursorintelligence.com/features/risk-based-prioritisation): every known flaw scored from 0 to 100 and kept up to date, so you fix the riskiest first.
- [Alerts and reporting](https://www.precursorintelligence.com/features/alerts-and-reporting): alerts by email, in the app or by webhook as soon as we spot something, plus PDF reports you can share.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Know what is hitting your peers, sector by sector. Choose your sectors and see which of the 400-plus gangs we track are naming victims like you, who they have claimed and where, across every sector and country.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone