Ransomware Tracker: 43 New Leak-Site Claims in 24 Hours, Qilin Leads
Our daily count of ransomware leak-site activity for October 16, 2026: which groups were busiest and where the claimed victims are.
Key points
- 43 new leak-site claims in 24 hours.
- Qilin posted the most: 12.
- 13 groups were active.
Ransomware groups posted 43 new victim claims on their leak sites in the past 24 hours, according to our count of entries logged by the tracker ransomware.live. Qilin was the most active group with 12 claims.
At a glance
- Claims (24h)
- 43
- Active groups
- 13
- Most active
- Qilin (12)
- Countries
- 15
Which countries were hit most?
By country code, the claims break down as: US (16), GB (3), EG (2), IT (2), MX (2), BR (2).
Which sectors were named?
The most frequently named sectors were Technology (5), Manufacturing (5), Healthcare (4), Professional Services (4), Education (3).
How reliable are these claims?
Leak-site posts are claims made by criminal groups. They are not confirmation that an organisation was breached, that data was stolen, or that a ransom was demanded. We report the volume and pattern of claims, not the names.
Claims by group
| Group | Claims | Share |
|---|---|---|
| qilin | 12 | 27% |
| iah6477 | 6 | 13% |
| N0n | 5 | 11% |
| lockbit5 | 5 | 11% |
| incransom | 4 | 9% |
| akira | 3 | 6% |
| spacebears | 2 | 4% |
| Wallstreet | 1 | 2% |
How we counted
We counted entries first seen in the 24 hours to 04:55 UTC on October 16, 2026 in the public ransomware.live dataset and grouped them by the group, country and sector fields. Duplicate and undated entries are excluded.
What to do and how to stay safe: Ransomware
- EDR tools record process lineage to show how one program spawned another, revealing hidden persistence mechanisms.
- False positives increase significantly when EDR agents scan complex development environments or virtualization software.
- Incident responders use EDR data to map lateral movement, identifying which accounts were compromised after initial access.
Endpoint detection and response transforms raw endpoint data into actionable intelligence by tracking behavior rather than just signatures. Configure your agents to monitor critical processes and test your detection rules regularly to ensure they catch evolving threats.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many ransomware leak-site claims were posted in the last 24 hours?
43, by our count of the public data.
