Key points
- Qilin posted twelve of the forty-three new claims.
- Technology and manufacturing sectors saw five claims each.
- No victim names are publicly disclosed in these statements.
Security teams monitoring ransomware activity faced a significant spike in unverified theft statements over a recent twenty-four-hour period. Our data desk analysis of public trackers identified forty-three new leak-site claims posted by criminal groups. These statements assert that data has been stolen, though the claims remain unverified and victim identities are deliberately withheld by the attackers.
The Qilin ransomware group was the most active actor during this window, responsible for twelve of the forty-three claims. Other groups also contributed to the volume, with Iah6477 posting six claims and N0n and LockBit 5 each posting five. Incransom followed with four claims, while Akira posted three, Spacebears two, and Wallstreet one. This distribution highlights a fragmented landscape where multiple groups are aggressively asserting control over compromised data.
Geographic and sector distribution
The claims spanned several countries, with the United States accounting for the highest number at sixteen. The United Kingdom followed with three claims, while Egypt, Italy, Mexico, and Brazil each saw two claims attributed to them. This geographic spread shows that ransomware operators are targeting organisations across multiple regions. The diversity of locations reflects the global nature of the threat landscape observed in this specific twenty-four-hour window.
In terms of industry sectors, technology and manufacturing were the hardest hit, with five claims each. Healthcare and professional services sectors followed closely with four claims each, while education saw three. This distribution shows which industries were cited in the unverified statements. Security operations teams in these sectors should remain vigilant for signs of compromise, even if their organisation is not explicitly named in public trackers.
Our take on the response
The sheer volume of forty-three claims in a single day underscores the persistent threat of ransomware. While the lack of named victims prevents immediate identification of specific targets, the pattern of activity suggests ongoing operational tempo by these groups. Qilin posted the highest number of claims in this specific window. Teams should treat every claim as a potential indicator of broader trends, even without specific victim details.
What affected people can do
Organisations should verify their own systems for signs of unauthorised access or data exfiltration immediately. Check network logs for unusual outbound traffic or large data transfers that do not match normal business patterns. Employees should be reminded to report any suspicious emails or requests for credentials, as follow-up scams often exploit the confusion of a breach. Monitor official channels for any updates regarding specific groups, and ensure that backup systems are isolated and intact. Do not engage with any demands or communications from unknown sources claiming to have stolen data.
Background: Data exfiltration
Data exfiltration is the unauthorised transfer of sensitive information from a protected system to an external destination. Attackers use this technique to steal intellectual property, financial records or personal data. You can reduce risk by monitoring outbound traffic, enforcing least privilege access and maintaining a clear view of where your data resides.
Read the full guide: Data Exfiltration: How Attackers Steal Information and How to Stop It
What to do and how to stay safe: Qilin
- Review endpoint detection and response logs for indicators of compromise related to known ransomware groups.
- Verify the integrity of offline backups to ensure they are not encrypted or corrupted.
- Monitor dark web forums and leak sites for any mentions of your organisation’s name or domain.
- Conduct a threat intelligence review to understand the tactics and techniques used by active groups like Qilin.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many ransomware claims were posted in the last 24 hours?
Forty-three new leak-site claims were posted within a single twenty-four-hour period.
Which ransomware group was most active during this surge?
Qilin was the most active group, posting twelve of the forty-three claims.
Which sectors were most targeted in these claims?
Technology and manufacturing sectors each saw five claims, followed by healthcare and professional services with four each.