12OCT

Ransomware crews' claims fall to 815

2 min read

10:55UTC

Ransomware leak-site claims fell 23 per cent in September on ransomware.live's count, with Qilin's collapse the largest single part of the drop.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Leak-site claims fell 23 per cent in September, led by Qilin's drop from 162 to 74.

Ransomware gangs posted 815 victim claims on their leak sites in September, down from 1,060 in August, a 23 per cent drop on ransomware.live's count⁠¹. A claim is a gang's own assertion that it hit an organisation, and none is independently verified.

The Gentlemen retook first place on 106 claims. Qilin fell to 74 from 162, down 54 per cent, the third change at the top since late July. Qilin's fall of 88 claims was the largest single share of the overall drop.

Italy held third among victim countries on 28 claims, one ahead of Canada, after its August surge, though its count fell from 48. Both months here use ransomware.live's figures; the tracker used for August's coverage counted slightly differently, but the two agree on the August total within 3 per cent.

Deep Analysis

In plain English

Ransomware gangs publish the names of organisations they have attacked on websites called leak sites, to pressure them into paying. Researchers count those names each month to track how busy the gangs are. The tracker ransomware.live counted 815 new names in September, down from 1,060 in August. A gang called The Gentlemen posted the most, and Qilin, which led in August, posted fewer than half as many as before. These counts are the criminals' own claims, not confirmed attacks, and late postings often push a month's total up later.

Deep Analysis

Root Causes

Ransomware affiliates keep most of each ransom, with revenue shares reported at 70 to 90 per cent, so they move freely to whichever programme pays best or seems safest. Brands rise and fall with affiliate loyalty, not with technical capability.

Leak-site posting is a choice the crew makes after a breach, often weeks later, and sometimes never if the victim pays. Monthly counts therefore measure posting behaviour, which lags and understates actual intrusions.

What could happen next?

Meaning
A single crew's drop drove most of September's fall, so the figure says more about Qilin than about ransomware overall.
Risk
Revisions as late postings arrive may lift September towards August's level, erasing the apparent fall.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In March 2024 the ALPHV gang, also called BlackCat, vanished after taking a ransom from Change Healthcare, apparently cheating its own affiliate. The affiliates moved to RansomHub, which became the most active brand within months, a leadership change driven by where affiliates chose to post.

Counter-parallel: In 2022 the Conti gang's internal chats leaked after it backed Russia's invasion of Ukraine, and the brand closed in May. Its members dispersed into Black Basta, Royal and others, and overall attack volumes did not fall, showing a top crew's collapse need not shrink the market.

A lower claim count does not mean lower ransom income: crews that post less may be settling more cases privately. Leak-site data captures victims who refused to pay or have not yet paid.

The United States carried 271 of September's tagged claims, Germany 34 and the UK 26, so US firms still absorb most of the public extortion pressure measured this way.

Consensus view: Group-IB traced The Gentlemen to a split from Qilin's affiliate programme, and the lead has now changed hands three times since late July. Leadership swaps of that speed point to affiliates moving their posting between programmes rather than to any change in how many companies are hacked.

Counter-view: Bitdefender's June debrief found affiliates cross-claiming victims already posted by rival crews, so a monthly count mixes fresh breaches with re-posts. Recent months also rise as late postings are scraped, and ThreatVectr revised both its July and August totals upward, and ransomware.live's September count of 815 is likely a floor for the same reason.

Key tension: Whether Qilin lost affiliates to The Gentlemen and others, or simply posted later, which only the October revision of September's figure will show.

Sources:ransomware.live

Mentions:The Gentlemen →Qilin →Italy →Bitdefender →Group-IB →ThreatVectr →Russia →Ukraine →Canada →ALPHV/BlackCat →United States →Germany →United Kingdom →Change Healthcare →RansomHub →Black Basta →Conti →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

ransomware.live· 12 Oct 2026

Read original →

Causes and effects

Caused by

Ransomware claims rose 11 per cent in August

August's rise in leak-site claims was followed by a 23 per cent fall in September.

Occurred 31 Aug 2026

Read story →

Qilin's own affiliate now outposts it

The Gentlemen first overtook Qilin in early August and retook first place in September.

Occurred 2 Aug 2026

Read story →

This Event

Ransomware crews' claims fall to 815

One gang's slump drove most of September's fall, so a single month says little about the trend.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.