Ransomware groups listed 7,807 companies on their leak sites in the first ten months of 2026, according to tracking firm Breachsense. That is already more than the 7,307 victims they listed in all of 2025, with two months still to go. If the monthly average holds, the year closes near 9,400.
October did the pushing. Breachsense counted 953 new victims in the month, up 21% from 789 in September, claimed by 81 groups and spread across 76 countries. The United States accounted for 408 of them, or 43%, up from 321 a month earlier.
The count has a built-in floor problem. It only records companies that a group publicly names. A victim who pays before the listing deadline never appears. So every figure here is a minimum, and the real number of attacks is higher by an amount nobody can measure from leak sites alone.
Where the pressure is landing
Healthcare is the clearest target. It had 117 victims in October, the most of any industry in a single month this year, and has ranked first for five months running. Its 2026 total stands at 720, against 538 for the whole of 2025. Hospitals pay because downtime has a body count, and the groups know it.
Germany is the other outlier. German companies account for 355 victims so far this year, up from 274 in all of 2025, and October’s 54 was the country’s worst month of 2026. Two smaller sectors also jumped. Law firms rose to 46 from 34, and logistics climbed to 34 from just 8 in September, its highest count of the year.
The group picture is fragmenting. Qilin has claimed 1,078 victims in 2026, more than any other operation and already above its 958 for 2025. But TheGentlemen led October with 135, and Breachsense now sees about 80 active groups in a month. Earlier in 2025 the typical figure was 30 to 40.
What the numbers say
More groups and more victims, at the same time, point to a market with low barriers to entry. Affiliates can rent tooling, buy access from brokers and pick soft targets. Takedowns of one big brand barely dent the total because the work just moves to the next name.
The sector shifts are the useful signal for defenders. Logistics quadrupling in a month and law firms rising together suggest groups are going after organizations that hold other companies’ data or keep other companies’ goods moving. Both have leverage beyond their own balance sheet.
The gap is the one leak-site data always leaves. It tells you who refused to pay, not how they were breached. For that, watch the patch notices. Most 2026 intrusions reported so far still start at an unpatched, internet-facing device.
For the market side of the response, see cybersecuritymarket.com.