Ransomware Watch · Aug 30, 2026

115 victim-claim posts in the last 36 hours across two cross-validated trackers (RansomLook, ransomware.live), spanning at least 30 named groups.

Most Active Groups

the gentlemen — 16 new victims

The most active poster in this window. Claims span manufacturing, retail, and professional services across multiple countries, including Glassdoor, G R Infraprojects, Thai Film Industries PCL, and ESB Puerto Rico Corp.

Sources: RansomLook

Qilin — 13 new victims

Claims include Newton County School System (US), Alter Consultores Legales, and The Frame Group, among others.

Sources: RansomLook · ransomware.live

dysphor1a — 7 new victims

Activity concentrated in Southeast and South Asia, including The University of Delhi, Ayudhya TH Insurance, and a claimed "Indonesian Police Database."

Sources: RansomLook

ShinyHunters — 3 new victims, including McKesson Corporation

ShinyHunters claimed McKesson Corporation, Jack Henry & Associates, and Elekta AB. The McKesson claim (284 million patient records) is independently corroborated by McKesson's own breach disclosure today — see the Daily Brief.

Sources: RansomLook

iah647 — 4 new victims

Claims against U.S. industrial and manufacturing firms Swagelok, Mat Holdings Inc, TRC Companies, and ProAmPac.

Sources: RansomLook · ransomware.live

Smaller but notable: Akira, Falcon, INC Ransom

Akira claimed BePeterson, Alumax, and JRT Mechanical. Falcon claimed Globus Medical and DistributionNOW (DNOW Inc.). INC Ransom claimed Oilquip Inc and Wittmann.

Sources: RansomLook · ransomware.live