State of Ransomware: January 2026
Published 1 February 2026 · ThreatVectr Intelligence
Ransomware groups claimed 714 attacks on organisations worldwide in January 2026, down 11% on the previous month's 802. 56 distinct groups posted at least one victim during the month, across 67 countries. The busiest single day was 25 January, with 65 victims listed.
Qilin was the most active operation of the month, claiming 112 victims — 16% of all listings. Akira (65) and Sinobi (55) followed. 3 groups appeared for the first time, including Cmdorganization, Linkc, Sicarii.
Manufacturing bore the heaviest targeting, with 112 claimed victims, ahead of Technology (94) and Business Services (80). By geography, United States accounted for 337 claims — 47% of the month — with United Kingdom (29) and Canada (25) next.
Claims per day — January 2026
Most active groups
- 1Qilin·11216%
- 2Akira2659%
- 3Sinobi2558%
- 4INC Ransom4487%
- 5Cl0p43466%
- 6The Gentlemen10345%
- 7Devman1304%
- 8Play2304%
- 9NightSpire16294%
- 10Tengu46284%
First seen this month:Cmdorganization, Linkc, Sicarii
Most-targeted sectors
- 1Manufacturing112
- 2Technology94
- 3Business Services80
- 4Healthcare51
- 5Construction50
- 6Consumer Services46
- 7Financial Services40
- 8Public Sector28
- 9Transportation/Logistics26
- 10Agriculture and Food Production23
Most-affected countries
- 1United States337
- 2United Kingdom29
- 3Canada25
- 4Germany22
- 5Italy22
- 6Spain21
- 7France19
- 8India18
- 9Taiwan13
- 10Brazil12
Every figure in this report counts a claim posted to a criminal leak site, observed via the monitoring service ransomware.live. A listing is an extortion tactic, not a confirmed breach: some claims are exaggerated, some are duplicates under new branding, and a few are outright false. Companies named in listings have not necessarily confirmed any incident, and ThreatVectr does not publish victim names from this dataset.
Cite this report
This report is free to cite and reproduce with attribution. Suggested citation:
ThreatVectr, “State of Ransomware: January 2026”, https://threatvectr.com/ransomware-tracker/reports/january-2026
Journalists and researchers: for questions about the data or methodology, contact the newsdesk.
Most ransomware starts with one email
The groups in this report overwhelmingly get in through phishing. Train2Secure runs realistic phishing simulations and short training that teach your team to spot the lure.