Ransomware groups named 1,127 organisations on their leak sites in October 2026, according to the HackerFeeds monthly report dated 31 October 2026. That is a 25.8% rise from 896 in September. We read two write-ups of that report, one from Tech Insider (1 November 2026) and one from QUE.com (1 November, updated 2 November). We did not open the HackerFeeds report itself, so every figure below is second-hand and attributed to those articles.
What counts as a “claim”
These are leak-site listings, which are criminal assertions rather than confirmed breaches. Both articles note that some listings may be inflated or recycled. Our assessment is that leak-site counts are useful for tracking group activity and shifts in targeting, but weak as a measure of confirmed incidents.
Volume and trend
- Total: 1,127 claims in October, against 896 in September (HackerFeeds, via both articles).
- Year to date: QUE.com cites Ransomnews for 9,163 claims in 2026 as of mid-morning on 1 November.
- Busiest day: 26 October, with 73 new names posted.
- Active groups: 79 groups posted at least one victim, including seven new to HackerFeeds.
- Data revisions: Tech Insider notes an earlier HackerFeeds page showed 977 for October through 29 October, before the final report showed 1,127. Late-month figures are therefore provisional.
The leading groups
| Group | October claims | September claims |
|---|---|---|
| N0n | 154 (13.7%) | 18 |
| The Gentlemen | 143 (12.7%) | 107 |
| Qilin | 140 (12.4%) | 76 |
| Akira | 35 | roughly steady |
| Silent Ransom Group | 33 | rose |
| Booba Project | 31 | 8 |
Per both articles, the top three together accounted for 437 claims, or 38.8% of the month. N0n’s jump from 18 to 154 is the largest single movement in the data. QUE.com links the transportation sector’s 76 listings largely to a single N0n batch of logistics firms. We profiled N0n earlier when its focus was maritime and shipping; the September-to-October change suggests a much higher posting tempo, though the sources do not explain what drove it.
Qilin nearly doubled from 76 to 140. The Gentlemen rose from 107 to 143; see our group profile. Neither source gives a reason for either change, so we do not offer one.
Sectors and countries
HackerFeeds sector counts, as reported by QUE.com and Tech Insider:
- Manufacturing: 162 (14.4%)
- Professional services: 129 (11.4%)
- Technology: 119 (10.6%)
- Healthcare: 114
- Transportation: 76
By country, the United States had 379 listings (33.6%), followed by Germany with 52 and the United Kingdom with 36. QUE.com says nearly 16% of listings gave no location, so country shares understate the true spread.
Why trackers disagree
Tech Insider contrasts three counting methods, which is a useful reminder when comparing our monthly reports:
- HackerFeeds counts leak-site claims (1,127 for October, 896 for September).
- Bitdefender counts claimed victims from its own telemetry. Its September figure was 790, up 30% year over year (debrief dated 6 October, as cited by Tech Insider).
- Ransomnews counts confirmed attacks: 877 year to date through 29 October, with 58 in September and 2 in October. Tech Insider calls the October figure a data-lag artefact.
Our earlier July roundup used Comparitech’s confirmed-attack methodology, so its totals are not directly comparable with the figures here.
Defensive takeaways
Our assessment, based on the reported mix rather than any source’s advice:
- Manufacturing and professional services are consistently exposed. Both rank in the top two sectors this month; review third-party access paths for suppliers and advisers.
- A fast-scaling group can swamp a sector. If N0n’s logistics batch is typical, supply-chain partners of any listed firm should expect follow-on phishing and fraud attempts using stolen correspondence.
- Do not treat a listing as proof of breach, or its absence as safety. Verify through your own telemetry and your vendors.
What we could not establish
- We found no evidence as of 3 November 2026 in the Tech Insider and QUE.com articles of a stated cause for N0n’s rise.
- We did not independently check the HackerFeeds or Ransomware.live data.
- Akira’s and Silent Ransom Group’s September baselines were described only qualitatively (“steady”, “rose”).