EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
Global observatory

Ransomware worldwide

Organizations named in claims, affected countries and the most active groups. An overview updated from public sources.

See the latest cases
Sources up to date Last collection Sources and methodology
The period at a glancelast 30 days · All data follows the selected filters
Reported cases5matching reports grouped into cases
In the last 24 hours0first public report
Countries involved15 cases with a known country
Groups in the claims4in the selected period
Reset filters
Where it happens

Countries of reported organizations

5 mapped cases
World map of victim countries stated in public claims

Hover for details. Click a country to zoom in, then drag the map to pan.

The map shows the country of organizations named by the sources.
  1. 0
  2. 1–9
  3. 10–99
  4. 100–999
  5. 1.000–9.999
  6. 10.000+

5 / 5 cases with a usable country · 0 without usable country data.

How it is evolving

Reporting trend

Cases per day · UTC

Date first reported by the sources, which may differ from the attack date. The current period is incomplete.

1 Reporting trend5 reported cases. Values are available in the table below the chart.28/08: 129/08: 030/08: 031/08: 001/09: 002/09: 003/09: 004/09: 005/09: 006/09: 007/09: 108/09: 109/09: 010/09: 011/09: 012/09: 013/09: 014/09: 015/09: 016/09: 017/09: 018/09: 019/09: 020/09: 021/09: 022/09: 023/09: 124/09: 125/09: 026/09: 0
28/0826/09
View chart values
PeriodReported cases
2026-08-281
2026-08-290
2026-08-300
2026-08-310
2026-09-010
2026-09-020
2026-09-030
2026-09-040
2026-09-050
2026-09-060
2026-09-071
2026-09-081
2026-09-090
2026-09-100
2026-09-110
2026-09-120
2026-09-130
2026-09-140
2026-09-150
2026-09-160
2026-09-170
2026-09-180
2026-09-190
2026-09-200
2026-09-210
2026-09-220
2026-09-231
2026-09-241
2026-09-250
2026-09-260
Who is claiming responsibility

Most active groups

Group profiles →
  1. The Gentlemen2 40%
  2. Panzer1 20%
  3. SafePay1 20%
  4. space bears1 20%

Share of cases in the period, by the group named by the sources.

Who is affected

Organization sectors

5 / 5
  1. Government & Defense1 20%
  2. Manufacturing1 20%
  3. Other1 20%
  4. Professional Services1 20%
  5. Technology1 20%

Classification reported by the sources. 0 cases without a usable sector.

What is happening

Latest reported cases

1–5 / 5

Open a case to review its sources. A claim does not establish a confirmed compromise.

First reportedOrganisationGroupCountrySectorSources
06:24 UTC Ligue se Grupo2 aggregated matches The Gentlemen Portugal OtherRansomLook · ransomware.live
17:44 UTC Tomix / Grupo JOPER2 aggregated matches spacebears Portugal ManufacturingRansomLook · ransomware.live
19:46 UTC hbpro.pt2 aggregated matches SafePay Portugal Professional ServicesRansomLook · ransomware.live
16:37 UTC Chip72 aggregated matches The Gentlemen Portugal TechnologyRansomLook · ransomware.live
11:22 UTC Directorate-General for Education3 aggregated matches Panzer Portugal Government & DefenseRansomLook · ransomware.live
Sources, coverage and methodology

This observatory describes claims in the monitored sources: worldwide ransomware coverage is partial. Reported cases are not a count of confirmed attacks or unique victims.

Reports with the same organization and group name, within 30 days of the first report, are grouped into one case. Letter case, spacing and known aliases are normalized; different names may still refer to the same organization.

11 source reports for 5 reported cases. Country and sector come from the sources: missing or conflicting data remains unassigned. Dates use UTC; the collection date is used if no publication date is available.

RansomLookLast successful collection
ransomware.liveLast successful collection

General articles, group profiles and technical portal checks are excluded from the counts.

View onion portal diagnostics →