State of Ransomware: April 2026
Published 1 May 2026 · ThreatVectr Intelligence
Ransomware groups claimed 803 attacks on organisations worldwide in April 2026, level with the previous month. 62 distinct groups posted at least one victim during the month, across 83 countries. The busiest single day was 27 April, with 99 victims listed.
Qilin was the most active operation of the month, claiming 103 victims — 13% of all listings. The Gentlemen (87) and DragonForce (63) followed. 12 groups appeared for the first time, including Lamashtu, M3rx, Aurora, Titan.
Business Services bore the heaviest targeting, with 170 claimed victims, ahead of Manufacturing (113) and Healthcare (77). By geography, United States accounted for 284 claims — 35% of the month — with Germany (48) and United Kingdom (44) next.
Claims per day — April 2026
Most active groups
- 1Qilin·10313%
- 2The Gentlemen18711%
- 3DragonForce1638%
- 4Apt73New587%
- 5Coinbasecartel4445%
- 6Akira1425%
- 7LockBit1405%
- 8INC Ransom3334%
- 9Krybit31223%
- 10NightSpire8202%
First seen this month:Lamashtu, M3rx, Aurora, Titan, Leakbazaar, Blackwater, Netrunner, Secpo and 4 more
Most-targeted sectors
- 1Business Services170
- 2Manufacturing113
- 3Healthcare77
- 4Consumer Services71
- 5Technology65
- 6Financial Services38
- 7Construction37
- 8Agriculture and Food Production33
- 9Transportation/Logistics32
- 10Public Sector29
Most-affected countries
- 1United States284
- 2Germany48
- 3United Kingdom44
- 4Canada27
- 5France27
- 6Italy24
- 7Australia19
- 8Spain16
- 9Mexico16
- 10Thailand16
Every figure in this report counts a claim posted to a criminal leak site, observed via the monitoring service ransomware.live. A listing is an extortion tactic, not a confirmed breach: some claims are exaggerated, some are duplicates under new branding, and a few are outright false. Companies named in listings have not necessarily confirmed any incident, and ThreatVectr does not publish victim names from this dataset.
Cite this report
This report is free to cite and reproduce with attribution. Suggested citation:
ThreatVectr, “State of Ransomware: April 2026”, https://threatvectr.com/ransomware-tracker/reports/april-2026
Journalists and researchers: for questions about the data or methodology, contact the newsdesk.
Most ransomware starts with one email
The groups in this report overwhelmingly get in through phishing. Train2Secure runs realistic phishing simulations and short training that teach your team to spot the lure.