Ransomware Leak-Site Listings Rise 30%, but Claims May Overstate Actual Breaches

ReliaQuest reported a 30% increase in organizations named on ransomware data-leak sites in Q3 2026, while warning that the rise does not establish equivalent growth in actual attacks. Forty-three newly observed groups accounted for 93% of the increase, with listings potentially including genuine intrusions, rebrands, recycled data and unsupported allegations. Manufacturing listings rose 70%, partly driven by Qilin and The Gentlemen, and approximately 85% of the overall increase occurred outside the United States.

ExfilSquad illustrates the uncertainty surrounding extortion claims: its published samples contained limited workforce and customer relationship data but did not substantiate the broader breach implied by its leak site. Researchers assessed that the group likely uses exposed credentials to obtain limited data and portrays that access as a major compromise. ReliaQuest recommends validating claims against internal evidence, investigating exposed credentials and prioritizing detection of shared ransomware techniques—including exploitation of internet-facing systems, vulnerable-driver abuse and Group Policy changes—rather than relying on group, sector or country rankings.