Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Non-profit and Civil Society: Who Is Hitting It.

As of Oct 19, 2026, 195 Non-profit and Civil Society organisations have been listed as ransomware victims on leak sites, 0.6% of all confirmed victims (about 1 in 167). The most active group in this sector is Qilin.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
195
Share of all victims
0.6%
Rank
#17 of 28 sectors
Most active group
Qilin
Most hit country
United States

Victims Posted Per Month.

Confirmed ransomware victims in Non-profit and Civil Society per month
MonthConfirmed victims
November 20252
December 20253
January 20269
February 20266
March 202614
April 202618
May 20269
June 20265
July 202612
August 20265
September 202611
October 2026 (month in progress)10
Latest confirmed ransomware leak-site victims in Non-profit and Civil Society
VictimClaimed byCountryIndustryData claimedPosted
Girl Scouts of Eastern Massachusetts
gsema.org
WallstreetUSUnited StatesNon-profit and Civil SocietyNot stated
victim
victimsupport.org.uk
SarcomaGBUnited KingdomNon-profit and Civil SocietyNot stated
Prodiel
prodiel.com
QilinESSpainNon-profit and Civil SocietyNot stated
CDA
cda.nl
MajinahanashiNLNetherlandsNon-profit and Civil SocietyNot stated
Anaergia | World-Leading Anaerobic Digestion Solutions
anaergia.com
Cry0CACanadaNon-profit and Civil SocietyNot stated
Asociación de Escribanos del Uruguay
aeu.org.uy
NightSpireUYUruguayNon-profit and Civil SocietyNot stated
Alcoholics Anonymous
aa.org
The GentlemenUSUnited StatesNon-profit and Civil SocietyNot stated
Aquatech
aquatech.com
The GentlemenUSUnited StatesNon-profit and Civil SocietyNot stated

Sector Briefings For Non-profit and Civil Society, Every Week.

The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.