Ransom-DB

Threat actors never sleeps. Neither do we. 👁️ The standard for Ransomware Intelligence just got higher. Ransom-DB monitors threat groups and thousands of incidents in real-time. 🌍 🗺️ Live Ransomware Threat Map 📡 Full API Access 📝 Ransomware Blog 📊 Statistics And much more ... ✅ Core access is still FREE. 🚀 Launch deal: 50% OFF Annual Subscriptions (RDB2026). 🚨 Start tracking: ransom-db.com

🚨 Ransom group "Qilin" publishes "ISAPRE CONSALUD" - Chile 🇨🇱 📍 Location: Santiago, Chile 🏢 Industry: Health Insurance 🔗 Website: consalud[.]cl Consalud is a major Chilean private health insurer (ISAPRE) based in Santiago, with offices in Las Condes and Huechuraba, serving about 488,000 beneficiaries. It reported 2024 revenue of CLP 652.861B and an operating loss of CLP 49,488M.

🔥 Daily Ransomware Digest - Total 45 Victims Top Groups: The Gentlemen - 24 victims Orova - 4 victims Akira - 3 victims LockBit - 3 victims Interlock - 2 victims BYOD - 1 victim Hyflock - 1 victim LeakNet - 1 victim NightSpire - 1 victim PEAR - 1 victim Top Attacked Countries: 🇺🇸 United States (15) 🇬🇧 United Kingdom (3) 🇩🇪 Germany (3) Top Attacked Industries: 🏫 Public education 🎓 Education ⚖️ Legal services The Gentlemen led the day with 24 victims, followed by Orova with 4, while Akira and LockBit posted 3 each. Notable targets included Mitsubishi Motors Ukraine, the regional distributor for the Japanese automaker, listed by The Gentlemen, and Michigan State University, a major U.S. public research institution claimed by BYOD. Activity clustered heavily in the United States, which absorbed 15 attacks, with intrusions distributed across public education, education, and legal services.

🚨 Ransom group "The Gentlemen" publishes "Secretaria de Estado de Saúde" - Brazil 🇧🇷 📍 Location: Cuiabá, Mato Grosso, Brazil 🏢 Industry: State Government - Public Health 🔗 Website: saude[.]mt[.]gov[.]br SES-MT is Mato Grosso’s health department, serving 141 municipalities. It manages state hospitals, the LACEN lab, and free-medication programs, and leads health policy, vaccination campaigns, and disease control across the state.

🚨 Ransom group "The Gentlemen" publishes "Antwerp House Dental" - United Kingdom 🇬🇧 📍 Location: Cambridge, England, United Kingdom 🏢 Industry: Healthcare (Dental Clinic) 🔗 Website: antwerphousedentistry[.]co[.]uk Antwerp House Dental, part of Antwerp Dental Group, provides NHS and private care in Cambridge, offering orthodontics, periodontics, endodontics, cosmetic and hygiene services across nine treatment rooms with a multidisciplinary clinical team.

🚨 Ransom group "The Gentlemen" publishes "RedBlink Technologies" - United States 🇺🇸 📍 Location: Danville, California, USA 🏢 Industry: Software & IT Services 🔗 Website: redblink[.]com RedBlink Technologies is a full-service AI and software development firm providing generative AI, ML/NLP, chatbots, web/mobile builds, cloud/DevOps, and cybersecurity via a hybrid US-India-Dubai model focused on rapid staff augmentation and scalable talent.

🚨 Ransom group "The Gentlemen" publishes "Hausarztpraxis Ries" - Germany 🇩🇪 📍 Location: Frickenhausen, Baden-Württemberg, Germany 🏢 Industry: Healthcare (General Practice) 🔗 Website: hausarzt-praxis-ries[.]de Hausarztpraxis Ries is a family-run general practitioner clinic providing primary care for patients 14+, including acute and chronic care, minor surgery, diagnostics, pain and palliative care, disease-management programs, travel certificates, home visits, and video consultations.

🔥 Weekly Ransomware Digest - Total 275 Victims Top Groups: The Gentlemen - 82 victims Qilin - 30 victims Booba - 16 victims WhiteArmor - 12 victims Genesis - 10 victims SafePay - 9 victims Rhysida - 9 victims Majinahanashi - 9 victims Emperador - 8 victims Everest - 8 victims Top Attacked Countries: 🇺🇸 United States 🇬🇧 United Kingdom 🇩🇪 Germany Top Attacked Industries: 🏭 Manufacturing 🏥 Healthcare 🎓 Education The Gentlemen led the week with 82 victims. Qilin followed with 30. Booba trailed with 16; WhiteArmor posted 12; Genesis recorded 10. Notable victim callouts: WhiteArmor listed Kucoin, a cryptocurrency exchange; BYOD listed Michigan State University, a major U.S. public university. Activity concentrated in the United States (114 attacks), with follow-on activity in Germany (17) and Italy (10). Most attacks targeted legal services (10), healthcare (9), and IT services (9); higher education (8) and education (6) were also affected. Victims included universities, healthcare providers, legal firms, and financial services.

🔥 Daily Ransomware Digest - Total 22 Victims Top Groups: Qilin - 11 victims Interlock - 2 victims Vexy - 2 victims Barracuda - 1 victim DireWolf - 1 victim Doommageddon - 1 victim Emperador - 1 victim Hyflock - 1 victim Shiba - 1 victim WhiteArmor - 1 victim Top Attacked Countries: 🇺🇸 United States (9) 🇩🇪 Germany (4) 🇹🇷 Turkey (2) Top Attacked Industries: 💻 IT services 🏥 Healthcare 🏬 Retail real estate Qilin led the day with 11 victims, while Interlock and Vexy followed with two claims each. Seven other threat actors each struck once, rounding out a fragmented tail. Activity clustered heavily in the United States with nine recorded incidents, followed by Germany with four. Sector impact remained dispersed, showing slight concentration in IT services and healthcare. Notable targets included Community Medical Center, a U.S. healthcare facility, and the municipal administration of Falls City, Nebraska, both claimed by Qilin.

🚨 Ransom group "Interlock" publishes "assiniboine dental group" - Canada 🇨🇦 📍 Location: Winnipeg, Manitoba, Canada 🏢 Industry: Healthcare - Dental Clinic 🔗 Website: N/A Assiniboine Dental Group is a family dental clinic in St. James, Winnipeg, operating since 1966. It provides general, cosmetic, orthodontic, implant, and oral surgery services, staffed by 20+ dentists and specialists with a large supporting team.

🚨 Ransom group "WhiteArmor" publishes "AmplifAI (GoDaddy instance)" - United States 🇺🇸 📍 Location: Plano, Texas, USA 🏢 Industry: Software (AI, Contact Center Performance) 🔗 Website: amplifai[.]com AmplifAI is a U.S.-based AI platform that boosts contact center performance through coaching, customer experience analytics, and automated quality assurance. Founded in 2016 and HQ’d in Plano, it also operates in Miami and Hyderabad; raised $33.7M Series B in Sept 2025.

🚨 Ransom group "DireWolf" publishes "My Cloud Grocer" - United States 🇺🇸 📍 Location: Brooklyn, New York, USA 🏢 Industry: Software (E-grocery platform) 🔗 Website: mycloudgrocer[.]com My Cloud Grocer, founded in 2012 and based in Brooklyn, builds a white-label e-grocery platform for supermarkets and grocery chains to run online stores and manage orders, fulfillment, logistics, payments, loyalty programs, and analytics.

🔥 𝐘𝐞𝐚𝐫-𝐭𝐨-𝐃𝐚𝐭𝐞 𝐑𝐚𝐧𝐬𝐨𝐦𝐰𝐚𝐫𝐞 𝐃𝐢𝐠𝐞𝐬𝐭 (as of November 2026) - 8864 𝐕𝐢𝐜𝐭𝐢𝐦𝐬 So far in 2026 there have been 8,864 ransomware victims, compared to 6,277 during the same period in 2025 – a 41.2% increase. 📅 𝐘𝐞𝐚𝐫-𝐭𝐨-𝐃𝐚𝐭𝐞 𝐌𝐨𝐧𝐭𝐡𝐥𝐲 𝐁𝐫𝐞𝐚𝐤𝐝𝐨𝐰𝐧: Jan - 825 Victims (2025: 609, +35.5%) 🟢 Feb - 925 Victims (2025: 707, +30.8%) 🟢 Mar - 894 Victims (2025: 993, -10.0%) 🔴 Apr - 786 Victims (2025: 545, +44.2%) 🟢 May - 755 Victims (2025: 494, +52.8%) 🟢 Jun - 825 Victims (2025: 474, +74.1%) 🟢 Jul - 835 Victims (2025: 537, +55.5%) 🟢 Aug - 1,044 Victims (2025: 546, +91.2%) 🟢 Sep - 897 Victims (2025: 564, +59.0%) 🟢 Oct - 1,075 Victims (2025: 795, +35.2%) 🟢 Nov - 3 Victims (2025: 713, -99.6%) 🔴 𝐓𝐨𝐩 𝐆𝐫𝐨𝐮𝐩𝐬: Qilin - 1138 Victims The Gentlemen - 955 Victims Akira - 421 Victims INC Ransom - 387 Victims DragonForce - 334 Victims LockBit - 284 Victims 0APT - 235 Victims Play News - 227 Victims NightSpire - 205 Victims CL0P - 181 Victims 📊 𝐇𝐢𝐠𝐡𝐥𝐢𝐠𝐡𝐭𝐬 (YTD vs 2025): 🏆 Top 5 groups: 36.5% of all attacks 📅 Peak Week: Week 33 (mid-Aug) (343) ⬆️ Emerging: - The Gentlemen (+1889.6%) - Genesis (+691.7%) - Medusa Locker (+587.5%) ⬇️ Declining: - Kraken (-95.7%) - Radar (-95.2%) - Sarcoma (-93.6%) 🆕 Newest groups in 2026: - Everstake - WhiteArmor - Mimori - Null Byte - Seven Deadly Sins - Hyflock - ScarlettGroup ℹ️ Percentages show year-to-date change vs 2025. 𝐓𝐨𝐩 𝐀𝐭𝐭𝐚𝐜𝐤𝐞𝐝 𝐂𝐨𝐮𝐧𝐭𝐫𝐢𝐞𝐬: 🇺🇸 United States 🇩🇪 Germany 🇨🇦 Canada 𝐓𝐨𝐩 𝐀𝐭𝐭𝐚𝐜𝐤𝐞𝐝 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐢𝐞𝐬: 🏥 Healthcare 🏗️ Construction ⚖️ Legal Services Ransomware activity this year involved several groups. Qilin conducted widespread operations, impacting entities such as Alamo Heights School District, Akkök Holding, and Acosol. The Gentlemen targeted Air Canada, Alcoholics Anonymous, and Aichi Electric. Akira and INC Ransom were also active, with INC Ransom affecting ACWA Power, Beacon Mutual Insurance, and Borough of Moonachie. LockBit maintained its presence, impacting ADT, Bladex, and the Andean Community of Nations. CL0P operations affected organizations such as Aldo Group, Continental, and GE. Notable activity from 0APT included AdventHealth Group, BASF SE, and Bupa Global Health. Attacks frequently affected North American and European organizations. Industries such as healthcare, manufacturing, and legal services experienced repeated targeting. Ransomware operations continued across diverse sectors and geographical regions.

🚨 Ransom group "Doommageddon" publishes "Referans Lab Ref-Lab" - Turkey 🇹🇷 📍 Location: Istanbul, Turkey 🏢 Industry: Healthcare - Clinical Laboratory 🔗 Website: referanslab[.]net Özel Referans Laboratuvarı (Referans Lab / RE-LAB) is a private clinical diagnostics provider founded in 1994. ISO 15189-accredited, it offers microbiology, biochemistry, immunology, genetics, and pathology services, serving 3M+ patients with 50+ specialists.

🔥 Monthly Ransomware Digest - Total 1071 Victims Top Groups: The Gentlemen - 130 victims Qilin - 117 victims n0n - 85 victims Akira - 34 victims Storm - 34 victims Booba - 29 victims INC Ransom - 29 victims Emperador - 27 victims NightSpire - 26 victims Everest - 26 victims Top Attacked Countries: 🇺🇸 United States 🇩🇪 Germany 🇨🇦 Canada Top Attacked Industries: ⚖️ Legal services 🏥 Healthcare 🏗️ Construction The Gentlemen led the month with 130 victims. Qilin followed with 117 victims, and n0n struck 85 times. Akira and Storm each claimed 34 victims. The Gentlemen listed Deloitte, a global professional services firm, and KFC, a major fast-food chain. Qilin attacked Gardaworld, a global security company, and Coop Italia, a large Italian retailer. Emperador listed AB InBev and Holcim. Everest targeted Flydubai and PwC. INC Ransom listed the University of Mississippi. Activity was heavily concentrated in the United States with 480 attacks. Germany and Canada also saw notable targeting. Legal services and Healthcare led sector attacks, followed by Construction and IT services.

🚨 Ransom group "Qilin" publishes "COMMUNITY MEDICAL CENTER, FALLS CITY NEBRASKA" - United States 🇺🇸 📍 Location: Falls City, Nebraska, USA 🏢 Industry: Healthcare (Hospital) 🔗 Website: cmcfc[.]org Community Medical Center is a nonprofit critical access hospital serving Richardson County and surrounding communities. It provides inpatient, outpatient, emergency care, specialty clinics (including cardiology and oncology), diagnostic imaging, and therapy services.

🚨 Ransom group "Payload" publishes "SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)" - Germany 🇩🇪 📍 Location: Magdeburg, Saxony-Anhalt, Germany 🏢 Industry: Government - Regional Development 🔗 Website: saleg[.]de SALEG is the state-owned land and regional development company of Saxony-Anhalt, Germany. Founded in 1991, it drives urban renewal, regional planning, brownfield remediation, heritage conservation, and infrastructure projects, including project development and public program management.

🚨 Ransom group "The Gentlemen" publishes "Skin Center" - United States 🇺🇸 📍 Location: Fort Lauderdale, Florida, USA 🏢 Industry: Healthcare - Dermatology & Cosmetic Surgery 🔗 Website: skincenter[.]com Skin Center is a long-established dermatology and cosmetic surgery clinic in Fort Lauderdale, now part of Forefront Dermatology (since 2021). It offers medical dermatology, Mohs surgery, cosmetic injectables and lasers, acne care, and aesthetics, with a second office in Pompano Beach.

🚨 Ransom group "The Gentlemen" publishes "REGiO Nord" - Germany 🇩🇪 📍 Location: Gransee, Brandenburg, Germany 🏢 Industry: Local Government / Regional Development 🔗 Website: regio-nord[.]com REGiO-Nord mbH is a publicly owned regional development agency for Oberhavel-Nord, owned by Zehdenick, Fürstenberg, Gransee, and Amt Gransee. It drives initiatives in education, economy, tourism, and marketing, and manages the Kooperationsfonds (~€8.9M in projects).