5SEP

Ransomware crews' claims fall to 815

2 min read

12:09UTC

Ransomware leak-site claims fell 23 per cent in September on ransomware.live's count, with Qilin's collapse the largest single part of the drop.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Leak-site claims fell 23 per cent in September, led by Qilin's drop from 162 to 74.

Ransomware gangs posted 815 victim claims on their leak sites in September, down from 1,060 in August, a 23 per cent drop on ransomware.live's count⁠¹. A claim is a gang's own assertion that it hit an organisation, and none is independently verified.

The Gentlemen retook first place on 106 claims. Qilin fell to 74 from 162, down 54 per cent, the third change at the top since late July. Qilin's fall of 88 claims was the largest single share of the overall drop.

Italy held third among victim countries on 28 claims, one ahead of Canada, after its August surge, though its count fell from 48. Both months here use ransomware.live's figures; the tracker used for August's coverage counted slightly differently, but the two agree on the August total within 3 per cent.

Deep Analysis

In plain English

Ransomware gangs publish the names of organisations they have attacked on websites called leak sites, to pressure them into paying. Researchers count those names each month to track how busy the gangs are. The tracker ransomware.live counted 815 new names in September, down from 1,060 in August. A gang called The Gentlemen posted the most, and Qilin, which led in August, posted fewer than half as many as before. These counts are the criminals' own claims, not confirmed attacks, and late postings often push a month's total up later.

Deep Analysis

Root Causes

Ransomware affiliates keep most of each ransom, with revenue shares reported at 70 to 90 per cent, so they move freely to whichever programme pays best or seems safest. Brands rise and fall with affiliate loyalty, not with technical capability.

Leak-site posting is a choice the crew makes after a breach, often weeks later, and sometimes never if the victim pays. Monthly counts therefore measure posting behaviour, which lags and understates actual intrusions.

What could happen next?

Meaning
A single crew's drop drove most of September's fall, so the figure says more about Qilin than about ransomware overall.
Risk
Revisions as late postings arrive may lift September towards August's level, erasing the apparent fall.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In March 2024 the ALPHV gang, also called BlackCat, vanished after taking a ransom from Change Healthcare, apparently cheating its own affiliate. The affiliates moved to RansomHub, which became the most active brand within months, a leadership change driven by where affiliates chose to post.

Counter-parallel: In 2022 the Conti gang's internal chats leaked after it backed Russia's invasion of Ukraine, and the brand closed in May. Its members dispersed into Black Basta, Royal and others, and overall attack volumes did not fall, showing a top crew's collapse need not shrink the market.

A lower claim count does not mean lower ransom income: crews that post less may be settling more cases privately. Leak-site data captures victims who refused to pay or have not yet paid.

The United States carried 271 of September's tagged claims, Germany 34 and the UK 26, so US firms still absorb most of the public extortion pressure measured this way.

Consensus view: Group-IB traced The Gentlemen to a split from Qilin's affiliate programme, and the lead has now changed hands three times since late July. Leadership swaps of that speed point to affiliates moving their posting between programmes rather than to any change in how many companies are hacked.

Counter-view: Bitdefender's June debrief found affiliates cross-claiming victims already posted by rival crews, so a monthly count mixes fresh breaches with re-posts. Recent months also rise as late postings are scraped, and ThreatVectr revised both its July and August totals upward, and ransomware.live's September count of 815 is likely a floor for the same reason.

Key tension: Whether Qilin lost affiliates to The Gentlemen and others, or simply posted later, which only the October revision of September's figure will show.

Sources:ransomware.live

Mentions:The Gentlemen →Qilin →Italy →Bitdefender →Group-IB →ThreatVectr →Russia →Ukraine →Canada →ALPHV/BlackCat →United States →Germany →United Kingdom →Change Healthcare →RansomHub →Black Basta →Conti →ransomware.live →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

ransomware.live· 12 Oct 2026

Read original →

Causes and effects

Caused by

Ransomware claims rose 11 per cent in August

August's rise in leak-site claims was followed by a 23 per cent fall in September.

Occurred 31 Aug 2026

Read story →

Qilin's own affiliate now outposts it

The Gentlemen first overtook Qilin in early August and retook first place in September.

Occurred 2 Aug 2026

Read story →

This Event

Ransomware crews' claims fall to 815

One gang's slump drove most of September's fall, so a single month says little about the trend.

Led to

N0n claims 38 firms, mostly maritime

N0n's batch put it on top of the October leak-site count after September's 815-claim month.

Occurred 12 Oct 2026

Read story →

SiteGuard hit; Qilin posts Keio files

Qilin's 71 October claims follow its September fall to 74.

Occurred 14 Oct 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.