Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
#6 of 28 industriesWatch Financial Services
Financial Services: Who Is Hitting It.
As of Oct 19, 2026, 1,136 Financial Services organisations have been listed as ransomware victims on leak sites, 3.5% of all confirmed victims (about 1 in 29). The most active group in this sector is Clop.
Updated continuously · figures as of Oct 19, 2026- Confirmed victims
- 1,136
- Share of all victims
- 3.5%
- Rank
- #6 of 28 sectors
- Most active group
- Clop
- Most hit country
- United States
Victims Posted Per Month.
1
8
18
36
37
35
41
23
44
58
50
21
| Month | Confirmed victims |
|---|---|
| November 2025 | 1 |
| December 2025 | 8 |
| January 2026 | 18 |
| February 2026 | 36 |
| March 2026 | 37 |
| April 2026 | 35 |
| May 2026 | 41 |
| June 2026 | 23 |
| July 2026 | 44 |
| August 2026 | 58 |
| September 2026 | 50 |
| October 2026 (month in progress) | 21 |
Most Active Groups Here
Most Hit Countries In This Industry
Latest Victims.
All 1,136 Financial Services victims →| Victim | Claimed by | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|---|
| Merit Financial Group meritfinancialadvisors.com | Storm | USUnited States | Financial Services | Not stated | |
| Finzly Corp finzly.com | N0n | USUnited States | Financial Services | Not stated | |
| ********rta.ch rta.ch | Cloak | CHSwitzerland | Financial Services | Not stated | |
| Via Credit Union viacu.org | Qilin | USUnited States | Financial Services | Not stated | |
| coopecaja.fi.cr coopecaja.fi.cr | INC Ransom | CRCosta Rica | Financial Services | Not stated | |
| Telcoe Federal Credit Union telcoe.com | Qilin | USUnited States | Financial Services | Not stated | |
| Europ Assistance South Africa europassistance.co.za | The Gentlemen | ZASouth Africa | Financial Services | Not stated | |
| North Bridge Venture Partners northbridge.com | The Gentlemen | USUnited States | Financial Services | Not stated |
Sector Briefings For Financial Services, Every Week.
The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.