Ransomware Tracker: 18 New Leak-Site Claims in 24 Hours, Safepay Leads
Our daily count of ransomware leak-site activity for October 1, 2026: which groups were busiest and where the claimed victims are.
Key points
- 18 new leak-site claims in 24 hours.
- Safepay posted the most: 3.
- 12 groups were active.
Ransomware groups posted 18 new victim claims on their leak sites in the past 24 hours, according to our count of entries logged by the tracker ransomware.live. Safepay was the most active group with 3 claims.
At a glance
- Claims (24h)
- 18
- Active groups
- 12
- Most active
- Safepay (3)
- Countries
- 8
Which countries were hit most?
By country code, the claims break down as: US (5), DE (4), GB (1), AR (1), BE (1), IT (1).
Which sectors were named?
The most frequently named sectors were Healthcare (4), Professional Services (3), Manufacturing (3), Other (3), Technology (2).
How reliable are these claims?
Leak-site posts are claims made by criminal groups. They are not confirmation that an organisation was breached, that data was stolen, or that a ransom was demanded. We report the volume and pattern of claims, not the names.
Claims by group
| Group | Claims | Share |
|---|---|---|
| safepay | 3 | 16% |
| play | 3 | 16% |
| aurora | 2 | 11% |
| lamashtu | 2 | 11% |
| qilin | 1 | 5% |
| N0n | 1 | 5% |
| Vexy Ransomware | 1 | 5% |
| interlock | 1 | 5% |
How we counted
We counted entries first seen in the 24 hours to 13:28 UTC on October 01, 2026 in the public ransomware.live dataset and grouped them by the group, country and sector fields. Duplicate and undated entries are excluded.
Frequently asked questions
How many ransomware leak-site claims were posted in the last 24 hours?
18, by our count of the public data.
