Open intelligence

RANSOMWARE TRACKER

Tracking the real-world impact of ransomware attacks across organisations, municipalities and critical sectors — explained for leaders, not just IT.

■ Maintained by Jan Kaastrup, cyber investigator & author

29010

Tracked incidents

1164

Last 30 days

284

Active groups

Danish targets

📅 Data from 01/01/2022 to 30/07/2026 ↻ Last updated 30/07/2026 01:51

Using open intelligence professionally?

This site aggregates and curates publicly available threat material. CTI Threat Cloud from CSIS does the same — as a managed service with real-time data, broader source coverage and integration into your security infrastructure.

See CTI Threat Cloud →

🔒

Login required

Incident details including company names are only available to authenticated users.

No account? Contact Jan Kaastrup.

Top groups in period

All groups in period

1 2 3 → 52 groups, page 1/3

Activity trend

Ransomware attacks

Showing data for: 📅 Last 7 days 🌐 All countries ■ All sectors Compared to: vs. preceding 7 days

319

Incidents in period

Active groups

38%

Data leaked

Risk by sector:

By sector

❓ Ukendt 32% (103)

🏭 Produktion 19% (62)

🏥 Sundhed 12% (37)

💻 Teknologi 11% (34)

🛒 Detail 7% (22)

🎓 Uddannelse 5% (17)

⚡ Energi 4% (12)

🏦 Finans 3% (11)

🚛 Transport 3% (11)

🏢 Statslig 3% (10)

Distribution

Most active groups in period

📅 Last 7 days | 🌐 All countries

1 TheGentlemen

41 (16.4%) 2 Global secret group

19 (7.6%) 8 Nightspire

15 (6%) 9 Genesis

12 (4.8%) 10 INC Ransom

12 (4.8%) 11 Safepay

11 (4.4%) 12 M3rx

4 (1.6%) 13 Shinyhunters

4 (1.6%) 14 Anubis

4 (1.6%) 15 DragonForce

4 (1.6%)

Geography — by country

Showing attacks in the past 7 days — compared to the preceding 7 days

Count = attacks in selected period | % = share of total | Badge = vs. prior same period

🇩🇰 Danmark

0 (0%) —

🇳🇴 Norge

0 (0%) —

🇫🇮 Finland

2 (0.4%) ▲ +1 (+100%) (1→2)

🇸🇪 Sverige

3 (0.6%) → 0 (3→3)

🌐 International

107 (23%) ↑ +25 (+30%) (82→107)

🇺🇸 USA

74 (15.9%) ▲ +48 (+185%) (26→74)

🇮🇳 Indien

13 (2.8%) ▲ +9 (+225%) (4→13)

🇨🇦 Canada

12 (2.6%) ▲ +8 (+200%) (4→12)

🇩🇪 Tyskland

9 (1.9%) ↓ -3 (-33%) (12→9)

🇫🇷 Frankrig

9 (1.9%) ▲ +5 (+125%) (4→9)

🌐 Brasilien

8 (1.7%) ↑ +1 (+14%) (7→8)

🇬🇧 UK

8 (1.7%) ↑ +1 (+14%) (7→8)

🌐 Argentina

6 (1.3%) → 0 (6→6)

🇦🇺 Australien

5 (1.1%) ▲ +3 (+150%) (2→5)

🇮🇹 Italien

5 (1.1%) ▲ +4 (+400%) (1→5)

🌐 Colombia

4 (0.9%) ↑ +1 (+33%) (3→4)

Current assessment

▲ MODERAT

Trusselsbillede lige nu

Jan og Michael opdaterer løbende dette afsnit med deres aktuelle vurdering af trusselslandskabet.

Jan Kaastrup & Michael Sjøberg

Updated 29. 5. 2026

🔒

Login required

Leaked chat transcripts are only available to authenticated users.

No account? Contact Jan Kaastrup.

About this tracker

This tracker is maintained by Jan Kaastrup — a cyber investigator who has worked 200+ ransomware cases. The goal: make attack data understandable for leaders and journalists, not just security analysts.