Key points
- N0N accounted for 14 of the 23 leak-site claims recorded in a single day.
- Victims from the United States represented nearly half of the reported incidents.
- Healthcare and professional services were among the most frequently targeted sectors.
A sudden spike in ransomware activity occurred recently, with criminal groups publishing 23 unverified claims on their leak sites within a 24-hour period. Our data desk analysis of public information from ransomware.live tracked these statements. The N0N group was the most active actor, responsible for 14 of these claims. Other groups involved included Qilin, Rhysida, Emperador, BrainCipher, Dragonforce, and Incransom.
In plain English
Leak sites are online portals where ransomware operators post details about organisations they have allegedly compromised. These claims are self-reported by the attackers and are not independently verified. The purpose is to pressure victims into paying ransoms by threatening to publish stolen data. Our analysis counted only these public statements, not confirmed breaches. We deliberately omit victim names to protect privacy and avoid amplifying the criminals' messaging.
The background
The distribution of claims by country shows the United States was the most affected, with 10 reported incidents. Canada followed with two claims, while Australia, Morocco, Peru, and Colombia each had one. By sector, healthcare organisations faced the most claims, with four reported cases. Professional services and technology sectors each saw two claims. Transportation, government, and defence sectors each had one reported claim.
What changes now
Managed service providers should monitor these trends to anticipate potential spikes in support requests. The concentration of claims in healthcare and professional services suggests these sectors remain high-value targets. While these are unverified claims, the volume indicates active operations by multiple ransomware groups. Providers should use this data to reinforce client communications about ransomware risks and preparedness.
What to do and how to stay safe: N0N
- Review current backup strategies to ensure data can be restored without paying ransoms.
- Verify that endpoint detection and response tools are active on all client systems.
- Monitor official channels for unverified leak-site claims related to your clients.
- Update incident response plans to include communication templates for potential breaches.
Step-by-step guide: Ransomware Recovery Plans: 6 Misunderstandings That Block Restoration
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware group was most active?
N0N was the most active, with 14 claims in the 24-hour period.
Were the victims identified in the report?
No, victim names are deliberately not reported in our analysis.
How many total claims were recorded?
There were 23 ransomware leak-site claims recorded in 24 hours.
