Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
#8 of 28 industriesWatch Retail
Retail: Who Is Hitting It.
As of Oct 19, 2026, 1,007 Retail organisations have been listed as ransomware victims on leak sites, 3.1% of all confirmed victims (about 1 in 32). The most active group in this sector is Clop.
Updated continuously · figures as of Oct 19, 2026- Confirmed victims
- 1,007
- Share of all victims
- 3.1%
- Rank
- #8 of 28 sectors
- Most active group
- Clop
- Most hit country
- United States
Victims Posted Per Month.
4
5
21
31
31
45
22
30
46
59
54
33
| Month | Confirmed victims |
|---|---|
| November 2025 | 4 |
| December 2025 | 5 |
| January 2026 | 21 |
| February 2026 | 31 |
| March 2026 | 31 |
| April 2026 | 45 |
| May 2026 | 22 |
| June 2026 | 30 |
| July 2026 | 46 |
| August 2026 | 59 |
| September 2026 | 54 |
| October 2026 (month in progress) | 33 |
Most Active Groups Here
Most Hit Countries In This Industry
Latest Victims.
All 1,007 Retail victims →| Victim | Claimed by | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|---|
| Belcorp belcorp.biz | Qilin | PEPeru | Retail | Not stated | |
| Quikrete quikrete.com | Helix | USUnited States | Retail | Not stated | |
| Pure Options pureoptions.com | Play | USUnited States | Retail | Not stated | |
| Verano Holdings verano.com | The-seven-deadly-sins | USUnited States | Retail | 2.4 MB | |
| Segres Systec segres.com | Qilin | PEPeru | Retail | Not stated | |
| buckle buckle.com | Iah6477 | USUnited States | Retail | 144.5 GB | |
| Enchanted Fine Jewellery enchantedfinejewellery.in | Vexy-ransomware | INIndia | Retail | Not stated | |
| Somali Immigration and Nationality Agency (HSJ); Ministry of Justice and Constitutional Affairs etas.gov.so | ShinyHunters | SOSomalia | Retail | Not stated |
Sector Briefings For Retail, Every Week.
The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.