The 2026 Half-Year Ransomware Index

This index is generated directly from the live Darkfield corpus, so the figures below move with the dataset rather than freezing at publication. It covers Jan 2026 – Jun 2026 of public ransomware leak-site activity. Every number traces back to a permanent dossier you can open and verify.

Who claimed the most

A small number of operators account for a disproportionate share of public disclosures. These are the busiest brands by claimed victims in the corpus right now — each links to its live operator dossier.

Which sectors absorbed the claims

Ransomware targeting is not evenly distributed — operators specialise. The sector index tracks the full breakdown; the leaders are below.

Where the victims are

Geographic concentration follows both where ransomware crews focus and where disclosure is most public. The full picture lives on the country index.

The shape of the half-year

Monthly disclosure volume across all tracked operators. Recent months are frequently revised upward as operators back-date and re-post claims, so the final bar is a floor, not a ceiling.

How to read these numbers

Every figure here is a count of public claims made by criminal operators on their own leak sites — not a census of all ransomware activity, and not a set of verified breaches. Attacks settled quietly never appear; re-listings can momentarily inflate a month. The full provenance, definitions and limits are documented in our methodology.

Orizon. (2026). The 2026 Half-Year Ransomware Index. Darkfield. https://darkfield.orizon.one/research/2026-ransomware-half-year-index

<iframe src="https://darkfield.orizon.one/embed/stats" width="100%" height="240" loading="lazy" title="Darkfield live ransomware statistics" style="border:1px solid #23262b;border-radius:12px;max-width:560px"></iframe>
<p style="font:12px sans-serif">Source: <a href="https://darkfield.orizon.one/research/2026-ransomware-half-year-index">The 2026 Half-Year Ransomware Index</a> by <a href="https://orizon.one">Orizon</a></p>