RansomwareNov 4, 2026

Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake

Ransomware leak site victim counts increased 30% in Q3 2026, but many claims may be fake.

Ransomware leak site victim counts saw a 30% increase in Q3 2026, but researchers caution that this does not reflect a true rise in attacks. Much of this growth is attributed to new, unproven ransomware groups, some of whom are suspected of fabricating their claims or recycling old data. Analysts suggest that bulk releases and low-risk data samples are indicators of potentially false allegations, urging defenders to verify claims before acting.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

The lesson from this incident

Full lesson

A 30% rise in ransomware leak site victim listings in Q3 2026 is misleading, with researchers attributing much of the growth to unproven or newly emerged groups fabricating breaches or recycling old stolen data. This matters because organizations and media may overreact to false claims, diverting incident response resources and causing reputational harm to businesses that were never actually compromised. Defenders who fail to verify breach claims before acting risk being manipulated into revealing sensitive internal information or making premature public disclosures. The trend also dilutes threat intelligence quality, making it harder to distinguish genuine incidents from noise. Robust verification processes and mature incident response playbooks are essential to avoid being misled by opportunistic threat actors.

What helps against this

How we list vendors

ReliaQuest research

Breach and attack simulation
You only find out whether your security tools stop an attack when a real attacker tries.
For exampleAttackIQ Ready SafeBreach Validate Picus Security Picus Autonomous Penetration Testing all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleDataminr Threat Intelligence CrowdStrike Falcon Adversary Intelligence Recorded Future Cyber Operations all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — Global Secret Group
malware — crpx0
malware — Storm
malware — Stormous
malware — ExfilSquad
malware — Emperador
malware — DragonForce
malware — LockBit

Entities

Global Secret Group (threat_actor)crpx0 (threat_actor)Storm (threat_actor)Stormous (threat_actor)ExfilSquad (threat_actor)Emperador (threat_actor)