Ransomware Intelligence / Sectors / Technology

Sector

Ransomware in Technology

Software, IT services, managed service providers and hardware vendors.

  • 32claims, 7 days
  • 93claims, 30 days
  • 260claims, 90 days
  • 2026-10-15most recent claim

Leak-site listings are claims made by criminals, not confirmed incidents. Sector is assigned from the public listing with an automated classifier and a confidence score; 14% of claims in the last 30 days are not yet classified. If a classification looks wrong, tell us.

Activity, last 26 weeks

New leak-site claims per week against technology organisations.

Week of 2026-04-20: 0Week of 2026-04-27: 0Week of 2026-05-04: 0Week of 2026-05-11: 0Week of 2026-05-18: 0Week of 2026-05-25: 0Week of 2026-06-01: 0Week of 2026-06-08: 0Week of 2026-06-15: 0Week of 2026-06-22: 0Week of 2026-06-29: 0Week of 2026-07-06: 0Week of 2026-07-13: 2Week of 2026-07-20: 13Week of 2026-07-27: 23Week of 2026-08-03: 18Week of 2026-08-10: 31Week of 2026-08-17: 25Week of 2026-08-24: 19Week of 2026-08-31: 10Week of 2026-09-07: 20Week of 2026-09-14: 14Week of 2026-09-21: 23Week of 2026-09-28: 19Week of 2026-10-05: 22Week of 2026-10-12: 21
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Most active groups, last 90 days

  1. the gentlemen 30
  2. n0n 16
  3. qilin 15
  4. direwolf 14
  5. everest 9
  6. clop 8
  7. orova 8
  8. panzer 8
  9. shinyhunters 8
  10. crpx0 7

Countries, last 90 days

  1. United States 75
  2. Unknown 37
  3. Brazil 13
  4. India 10
  5. Germany 9
  6. United Kingdom 9
  7. Canada 7
  8. France 7
  9. Italy 7
  10. Singapore 6
  11. Spain 5
  12. Japan 5
  13. Switzerland 4
  14. Chile 4
  15. Taiwan 4

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog is not sector-specific; if you run the product, patch it.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Weekly brief

Weekly briefs cover manufacturing, critical infrastructure and K-12 education today. Subscribe to one of those, or write to info@securitysnares.com if you would read one for technology.

Request a conversation

Other sectors

Data sources

  • Source: CISA KEV
    updated 2 hours ago
  • Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.
    updated 2 hours ago
  • Source: RansomLook
    updated 2 hours ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.
    updated 2 hours ago

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.