Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Government and Public Sector: Who Is Hitting It.

As of Oct 19, 2026, 663 Government and Public Sector organisations have been listed as ransomware victims on leak sites, 2.1% of all confirmed victims (about 1 in 48). The most active group in this sector is Qilin.

Updated continuously ยท figures as of Oct 19, 2026
Confirmed victims
663
Share of all victims
2.1%
Rank
#10 of 28 sectors
Most active group
Qilin
Most hit country
United States

Victims Posted Per Month.

Confirmed ransomware victims in Government and Public Sector per month
MonthConfirmed victims
November 20253
December 202512
January 202624
February 202621
March 202628
April 202634
May 202625
June 202629
July 202637
August 202631
September 202627
October 2026 (month in progress)17
Latest confirmed ransomware leak-site victims in Government and Public Sector
VictimClaimed byCountryIndustryData claimedPosted
WSBI-ESBG
wsbi-esbg.org
PlayBEBelgiumGovernment and Public SectorNot stated
The Excalibur Group
theexcaliburgroup.com
QilinUSUnited StatesGovernment and Public SectorNot stated
police.rajasthan.gov.in
rajasthan.gov.in
ScarlettgroupINIndiaGovernment and Public SectorNot stated
Commune Du Tampon
letampon.fr
QilinFRFranceGovernment and Public SectorNot stated
Ecuadors National Police
policia.gob.ec
The GentlemenECEcuadorGovernment and Public SectorNot stated
Tech Electronics
techelectronics.com
StormUSUnited StatesGovernment and Public SectorNot stated
Ecuador police headquarters
policia.gob.ec
HyflockECEcuadorGovernment and Public SectorNot stated
CNESTEN
cnesten.org.ma
QilinMAMoroccoGovernment and Public SectorNot stated

Sector Briefings For Government and Public Sector, Every Week.

The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.