Report by ReliaQuest
Ransomware and Cyber Extortion in Q2 2026
Key Findings
The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1.
The Gentlemen posted 101 victims in April, 77 in May, and 122 in June.
Deadlock emerged in June 2026 with 75 named victims in a single month.
Deadlock was absent from public data-leak sites for 11 months before emerging publicly.
Qilin fell from 111 data leak posts in April to 79 in June, a 29% decrease.
The top 11 tracked ransomware groups accounted for 1,368 victim claims across 99 countries in Q2.
Ransomware attacks spread across 90 ransomware groups and 99 countries.
Ransomware groups posted 2,252 victims in Q2, down 15% from Q1 and up about 51% year over year.
The Gentlemen posted 300 victims in Q2, edging out Qilin with 289 victims.
DragonForce dropped from 65 data leak posts to 27 posts, a 58% decrease.
Coinbase Cartel collapsed from 45 data leak posts to 4 posts, a 91% decrease.
PSTS led sector targeting for the fifth consecutive quarter.
The US absorbed 1,094 ransomware victim data leak posts in Q2, roughly 49% of observed activity and nine times the volume of the next country.
Professional, Scientific, and Technical Services (PSTS) recorded 437 ransomware victim posts across the top 11 groups and accounted for 32% of tracked activity.