Ransomware groups listed 7,807 companies on leak sites from January to October 2026, compared with 7,307 in all of 2025

Breachsense, a dark web monitoring API, counted 7,807 ransomware victims on leak sites from January to October 2026. The Breachsense October 2026 Ransomware Report shows 2026 has already passed 2025's full-year total of 7,307 victims.

In October, 953 companies appeared on leak sites, up 21% from 789 in September. October's victims were listed by 81 ransomware groups and based in 76 countries. If the 2026 monthly average holds, groups will list about 9,400 victims this year.

Breachsense counts each company listed on a ransomware leak site as one victim. Companies that pay before a group lists them aren't counted.

Other findings include:

• October's victims included 117 healthcare companies, the most for any industry in one month this year. Healthcare has ranked first for five months in a row.
• So far in 2026, 720 healthcare companies have appeared on leak sites, against 538 in all of 2025.
• US companies accounted for 408 of October's victims (43%), up from 321 in September.
• German companies listed in 2026 already number 355, more than the 274 in all of 2025. The 54 German companies listed in October were the most in any month this year.
• Law firms made up 46 of October's victims, up from 34 in September.
• Ransomware groups listed 34 logistics companies in October, up from 8 in September and the most this year.

"Checking leak sites for your own company's name isn't enough. Vendors such as your law firm keep copies of your data. When a vendor gets hit, the leak site lists the vendor as the victim, not you. Your data can leak along with the vendor's files," said Josh Amishav, Founder and CEO of Breachsense.

The full report is available at https://www.breachsense.com/ransomware-reports/october-2026/?utm_source=businesswire&utm_medium=press-release&utm_campaign=ransomware-2026-exceeds-2025

About Breachsense

Breachsense is a dark web monitoring API for security teams and MSSPs who need to know when their own data, or a vendor's, has already been stolen. Alongside stolen credentials and session tokens, it indexes the files ransomware groups leak, so teams can search them for their own company's data. When a new leak matches a monitored term, such as a domain, Breachsense sends an email or webhook alert.

https://www.breachsense.com/?utm_source=businesswire&utm_medium=press-release&utm_campaign=ransomware-2026-exceeds-2025
LinkedIn: https://www.linkedin.com/company/breachsense/

View source version on businesswire.com: https://www.businesswire.com/news/home/20261111995858/en/