Ransomware Watch · Aug 18, 2026
RansomLook logged 51 victim disclosures over the past 36 hours, spanning 20 different ransomware groups.
Group Activity Ranking
- shinyhunters— 10 disclosures, the most active this edition. Victims include several well-known consumer and healthcare brands: Carhartt, Baxter International, Alcon, Lumenis, Cook Medical, Sharecare, Questel, and Brinks Home, plus a separate "NOTICE OF WARNING" posting.
- inc ransom— 8 disclosures, mostly small and mid-sized businesses and professional organizations: Third Coast Bancshares, Foresee Pharmaceuticals, SpearFin Ltd, Lansing Urgent Care, Otter Tail County (Minnesota), and others.
- qilin— 5 disclosures, including University of the West Indies and GSW Gemeinschaftsstadtwerke (a German municipal utility).
- panzer— 4 disclosures, including DL E&C and Castilla La Mancha (a target associated with the Spanish autonomous community).
- direwolf— 4 disclosures, including Arizona State University(a US university) and Eva AI Limited.
- play— 3 disclosures: Bridgeport Capital Services, Sam Pack Auto Group, Woodhaven Association.
- aurora— 3 disclosures: Planungsgruppe M+M AG, Natco Home Group, Lloyd Coils Europe.
- the gentlemenand global secret group— 2 each.
- Groups with a single disclosure each: leaknet, emperador, nightspire, audit team, anubis, insomnia, xpl0itrs, lockbit5, dragonforce, bravox.
Targets Worth Watching
- xpl0itrs claims an attack on BMW Group— the only disclosure this edition involving a global automaker.
- leaknet claims to have published 11TB of archive data from NYC Health + Hospitals— a large US public healthcare system, and substantial in scale.
- direwolf claims an attack on Arizona State University— an education-sector target; direwolf's same batch this edition also swept in two game studios (Mighty Kingdom, Wishfully Studios).
- shinyhuntersnamed a cluster of medical device and pharmaceutical companies this edition (Baxter International, Alcon, Lumenis, Cook Medical; Foresee Pharmaceuticals was disclosed by inc ransom), leaving the healthcare and pharma sectors notably under pressure this round.
Source: RansomLook — Global Posts RSS (ransomlook.io). All of the above are victim claims published by the ransomware groups themselves, not independently verified, and represent only the groups' unilateral assertions.