Ransomware Intelligence / Sectors / Financial services

Sector

Ransomware in Financial services

Banks, credit unions, insurers, brokerages and fintech.

  • 15claims, 7 days
  • 51claims, 30 days
  • 185claims, 90 days
  • 2026-11-04most recent claim

Leak-site listings are claims made by criminals, not confirmed incidents. Sector is assigned from the public listing with an automated classifier and a confidence score; 12% of claims in the last 30 days are not yet classified. If a classification looks wrong, tell us.

Activity, last 26 weeks

New leak-site claims per week against financial services organisations.

Week of 2026-05-11: 12Week of 2026-05-18: 8Week of 2026-05-25: 8Week of 2026-06-01: 7Week of 2026-06-08: 9Week of 2026-06-15: 9Week of 2026-06-22: 9Week of 2026-06-29: 10Week of 2026-07-06: 11Week of 2026-07-13: 7Week of 2026-07-20: 16Week of 2026-07-27: 19Week of 2026-08-03: 14Week of 2026-08-10: 21Week of 2026-08-17: 25Week of 2026-08-24: 18Week of 2026-08-31: 13Week of 2026-09-07: 14Week of 2026-09-14: 11Week of 2026-09-21: 20Week of 2026-09-28: 8Week of 2026-10-05: 9Week of 2026-10-12: 13Week of 2026-10-19: 6Week of 2026-10-26: 15Week of 2026-11-02: 11
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Most active groups, last 90 days

  1. storm 22
  2. qilin 20
  3. the gentlemen 15
  4. coinbase cartel 12
  5. n0n 12
  6. crpx0 9
  7. lockbit5 9
  8. inc ransom 6
  9. clop 5
  10. dysphor1a 5

Countries, last 90 days

  1. United States 76
  2. Unknown 12
  3. Canada 9
  4. United Kingdom 6
  5. India 6
  6. South Africa 5
  7. Argentina 4
  8. Türkiye 4
  9. United Arab Emirates 3
  10. France 3
  11. Italy 3
  12. MM 3
  13. Netherlands 3
  14. Thailand 3
  15. BO 2

In the news

Recent ransomware stories in the security press about financial services organisations, picked by keywords in the headline.

Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog is not sector-specific; if you run the product, patch it.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Weekly brief

Weekly briefs cover manufacturing, critical infrastructure and K-12 education today. Subscribe to one of those, or write to info@securitysnares.com if you would read one for financial services.

Request a conversation

Other sectors

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 14 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology