Threat Watch · Aug 18, 2026

RansomLook logged 51 victim disclosures over the past 36 hours, spanning 20 different ransomware groups.

Group Activity Ranking

1. shinyhunters— 10 disclosures, the most active this edition. Victims include several well-known consumer and healthcare brands: Carhartt, Baxter International, Alcon, Lumenis, Cook Medical, Sharecare, Questel, and Brinks Home, plus a separate "NOTICE OF WARNING" posting.
2. inc ransom— 8 disclosures, mostly small and mid-sized businesses and professional organizations: Third Coast Bancshares, Foresee Pharmaceuticals, SpearFin Ltd, Lansing Urgent Care, Otter Tail County (Minnesota), and others.
3. qilin— 5 disclosures, including University of the West Indies and GSW Gemeinschaftsstadtwerke (a German municipal utility).
4. panzer— 4 disclosures, including DL E&C and Castilla La Mancha (a target associated with the Spanish autonomous community).
5. direwolf— 4 disclosures, including Arizona State University(a US university) and Eva AI Limited.
6. play— 3 disclosures: Bridgeport Capital Services, Sam Pack Auto Group, Woodhaven Association.
7. aurora— 3 disclosures: Planungsgruppe M+M AG, Natco Home Group, Lloyd Coils Europe.
8. the gentlemenand global secret group— 2 each.
9. Groups with a single disclosure each: leaknet, emperador, nightspire, audit team, anubis, insomnia, xpl0itrs, lockbit5, dragonforce, bravox.

Targets Worth Watching

• xpl0itrs claims an attack on BMW Group— the only disclosure this edition involving a global automaker.
• leaknet claims to have published 11TB of archive data from NYC Health + Hospitals— a large US public healthcare system, and substantial in scale.
• direwolf claims an attack on Arizona State University— an education-sector target; direwolf's same batch this edition also swept in two game studios (Mighty Kingdom, Wishfully Studios).
• shinyhuntersnamed a cluster of medical device and pharmaceutical companies this edition (Baxter International, Alcon, Lumenis, Cook Medical; Foresee Pharmaceuticals was disclosed by inc ransom), leaving the healthcare and pharma sectors notably under pressure this round.

Source: RansomLook — Global Posts RSS (ransomlook.io). All of the above are victim claims published by the ransomware groups themselves, not independently verified, and represent only the groups' unilateral assertions.