During the third quarter of 2026, organizations named on ransomware leak sites jumped by 30%—but experts caution that not all of the increase reflects actual attacks. Much of the surge comes from newly surfaced gangs, unverified claims, recycled data, and ambiguous leaks rather than confirmed intrusions.
What’s Fueling the Surge in Leak Site Volume
Leak sites—public-facing platforms where ransomware groups list victim organizations—are increasingly used to pressure victims into paying. Analysts have long relied on these lists to measure ransomware activity. The recent 30% rise in listed victims doesn’t necessarily equate to more breaches; instead, it reflects a boom in new names appearing, notably from groups with no prior activity. These newcomers, 43 in all, were responsible for 93% of the growth. Existing gangs posted only marginally more victims than before.
Patterns among the postings hint at inconsistencies. Some groups dump dozens of victim names in a single batch; others post steadily. For instance, “Global Secret Group” announced 48 victims in one go, while “crpx0” listed 47–41 of them at once—and has gone silent since August. Such batch releases raise suspicions that data may be repackaged or old rather than fresh breaches.
Specific Cases: Real Risk vs. Inflated Claims
Take the case of ExfilSquad, a group first spotted in July 2026. Its leak site included employee details—emails, phone numbers, job titles—alongside generic or blank data fields. The warning: those exposed accounts could be harvested from public code repositories like GitHub and then presented as evidence of significant unauthorized access. In many cases, the group posted threats of payment, but failed to follow up, and even listed allegedly victimized organizations without supplying any data samples. The damage is often limited to reputational fallout, phishing risk, and costly internal investigations.
Another example: an unverified ransomware claim targeting AB InBev by the group Emperador. No external confirmation or solid proof has emerged. And while some groups, like “Storm,” have posted dozens of victims—71 over 20 days—others seem to shadow established names closely. The group “Stormous” made its last post just weeks before “Storm” began listing victims, sparking speculation of rebranding or mimicking.
Advice for Organizations Named in Leak Lists
If your organization is named by a new or unknown group, treat the claim as unverified until you can confirm actual breach activity. Key questions to ask: Were internal systems compromised? Is there proof matching how the group claims the data was obtained? Is this group a new actor, a rebrand of something existing, or possibly someone just leveraging stolen or scraped data? Paying without proof only funds criminal operations. But ignoring genuine incidents may expose your people to phishing or expose sensitive data long term.
Defender best practices include reviewing internal logs, scrutinizing posted evidence for authenticity, monitoring for overlaps in tactics or infrastructure with known ransomware families (which could signal rebrands), and enforcing strong security hygiene across remote services, edge devices, and code repositories. Real adversaries often exploit exposed credentials or vulnerable systems rather than operating purely through public-facing leak sites.
Geographic & Sector Trends
Victims outside the U.S. accounted for most of the new names—about 85% of the added organizations. Meanwhile, U.S. victims rose by 9%, but its share of all listings dropped from 55% in Q1 through 49% in Q2 and down to 41% in Q3. Among industries, manufacturing saw a 70% rise in named victims, while professional, scientific, and technical services continue to be the most frequently targeted sector for six consecutive quarters.
The spectrum of ransomware groups includes more established actors like Qilin and The Gentlemen, who use sophisticated tactics—exploiting internet-facing services, deploying vulnerable signed drivers to bypass endpoint protection, and making unauthorized changes to Group Policy for lateral spread. These methods contrast with newer groups whose operations and motivations are less clear.
Bottom line: A larger number of gang names and leak site listings does not equal more real breaches. Many claims may be inflated or fabricated, making it crucial for security teams to vet every breach notification, assess supporting proof, and avoid reactionary payments. As the leak site ecosystem grows, distinguishing between authenticity and opportunism becomes a critical skill for modern defense.
