BlackFog

BlackFog is a cybersecurity company that develops data exfiltration prevention technology and publishes monthly ransomware tracking reports drawn from publicly disclosed victim data on ransomware leak sites. Its State of Ransomware series monitors victim counts by country and sector, the number of active ransomware groups in operation, and the group-level breakdown of claimed attacks, providing one of the few consistent month-over-month data series for measuring ransomware tempo.

BlackFog's May 2026 report recorded 95 publicly disclosed ransomware attacks worldwide across 17 countries, with the United States accounting for 54 and Australia for 18. Healthcare was the hardest-hit sector with 28 incidents. Qilin led all ransomware groups with 11 claimed victims, among 37 active groups — a figure that held firm despite the Europol Operation Saffron seizure of First VPN's 33 servers, confirming that enforcement actions targeting shared infrastructure do not materially reduce affiliate activity.

BlackFog's monthly series is widely cited by security teams, insurers and government agencies as a leading indicator of ransomware tempo. However, its counts reflect publicly disclosed incidents only — groups that do not post on leak sites, victims who pay without public disclosure, and incidents under active non-disclosure agreements are systematically excluded. The disclosed count is therefore a floor, not a ceiling. BlackFog's own annualisation from Q1 2026 data — 8,500 annual victims at current pace — exceeds 2025's 6,182 total, indicating the series is capturing a genuine acceleration even before adjusting for undisclosed incidents.