Key points
- Qilin posted 12 of the 43 new unverified leak-site claims recorded in the last 24 hours.
- The United States accounts for 16 of the claimed incidents, followed by the UK with three.
- Technology and Manufacturing sectors each report five claims, while Healthcare and Professional Services report four each.
Public data analysis conducted by our data desk shows a spike in ransomware leak-site activity, with 43 new claims appearing within a 24-hour period. These figures are drawn from the ransomware.live tracker and represent unverified statements made by criminal groups; specific victim identities are not disclosed in this dataset.
The distribution of these claims highlights Qilin as the most active group, responsible for 12 of the assertions. Other groups include iah6477 with six claims, N0n and LockBit5 with five each, IncRansom with four, Akira with three, SpaceBears with two, and Wallstreet with one. These counts reflect only the volume of public assertions, not confirmed breaches.
Geographic distribution
The United States is the most frequently cited location in these claims, with 16 instances. The United Kingdom follows with three claims. Egypt, Italy, Mexico, and Brazil each appear twice in the data. This geographic spread indicates where attackers are publicly stating they have targeted organizations, though the actual impact on infrastructure remains unverified by independent sources.
Sector exposure
Technology and Manufacturing sectors each account for five of the claims. Healthcare and Professional Services sectors report four claims each, while the Education sector accounts for three. These numbers show which industries are currently featured in criminal group communications. The data does not confirm whether these sectors are preferentially targeted or if the distribution reflects broader exposure trends.
Next steps
No confirmed patches or fixes are available for these specific incidents, as the claims are unverified. Teams should monitor official channels from the named groups for any changes in demand or data release timelines. Security operations centers should treat these public assertions as indicators of potential compromise until internal verification is complete. Do not assume a breach based solely on leak-site presence.
Signals worth monitoring
Teams usually check for unusual outbound traffic volumes that may indicate data exfiltration prior to encryption. Administrators should look for sudden changes in file extensions or the appearance of ransom notes on shared drives. Verify whether legitimate backup systems remain intact and accessible. Check authentication logs for impossible travel or credential stuffing attempts that often precede lateral movement. Ensure endpoint detection tools are alerting on known ransomware behaviors such as rapid file renaming or shadow copy deletion.
Background: Ransomware
Ransomware protection combines network segmentation, strict least-privilege access, and immutable backups to prevent encryption malware from spreading. You must detect initial access vectors like phishing or unpatched services, isolate infected systems immediately, and restore data from offline copies that attackers cannot modify or delete.
Read the full guide: What Is Ransomware Protection: How to Stop Encryption Attacks
What to do and how to stay safe: Qilin
- Verify the integrity of offline backups to ensure they are not connected to the live network.
- Review firewall logs for large data transfers to unknown external IP addresses.
- Isolate any systems showing signs of unauthorized file modification from the network.
- Monitor email inboxes for phishing attempts that may be linked to the active campaigns.
Step-by-step guide: Immutable Backups: Best Practices for Ransomware Resilience
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware group made the most claims?
Qilin made the most claims, with 12 assertions recorded in the 24-hour period.
How many countries are represented in these claims?
Six countries are represented: the US, UK, Egypt, Italy, Mexico, and Brazil.
Are these incidents confirmed breaches?
No, these are unverified statements by criminal groups; victim names are not reported.
