Data‑Leaking Ransomware Claims 854 Victims in 93 Countries in September 2026

What happened

DB Digest (DBD) published its September 2026 Data‑Leaking Ransomware (DLR) Report, documenting 854 distinct ransomware victims across 93 countries and islands. In the United States, 347 organizations in 48 states and the District of Columbia were compromised. All incidents were linked to 84 active ransomware operators that encrypt data, exfiltrate it, and threaten public disclosure unless a ransom is paid. The report also identified 11 previously unknown operators, such as BLACKLOCKS and BlueWhale, expanding the known threat ecosystem. DBD compiled the data from public breach notices, underground forums, and victim‑submitted tickets, providing a high‑confidence view of the ransomware landscape for the month.

Why it matters for trust and compliance

• Ransomware tests recovery before anything else. Check that backups are isolated and that restores have actually been rehearsed.

Who is affected

Recommended actions

1. Implement network‑level data‑exfiltration detection and restrict outbound traffic to known destinations
2. Maintain immutable, offline backups and conduct regular restore tests
3. Refresh incident‑response playbooks to include data‑leak negotiation and public‑relations procedures