Ransomware in the Finance & insurance sector
In the last 12 months, 290 organisations in Finance & insurance have been claimed by ransomware groups, 50 of them in the last 30 days. The figures come from the groups' own leak sites and are not verified unless stated; many victims pay and never appear.
Claimed victims290Finance & insurance · last 12 monthsClaimed victims50Finance & insurance · last 30 daysConfirmed by press2Finance & insurance · last 12 months
Explore with filters →🔔 Get alerts for Finance & insurance
Victims per month
- Nov 250
- Dec 250
- Jan 260
- Feb 260
- Mar 2618
- Apr 2641
- May 2634
- Jun 2633
- Jul 2638
- Aug 2676
- Sep 2650
- Oct 260
Most active groups (12 months)
Most affected countries
Recent victims
| Organisation | Group | Country | Claimed | Status |
|---|---|---|---|---|
| MCAP | N0n | Canada | 9/30/2026 | ◌ Claimed (unverified) |
| Maxwell Group | Brain Cipher | — | 9/29/2026 | ◌ Claimed (unverified) |
| Latitude Subroación | Brain Cipher | — | 9/29/2026 | ◌ Claimed (unverified) |
| SAMWUMED | The Gentlemen | South Africa | 9/29/2026 | ◌ Claimed (unverified) |
| Poca Valley Bank | Storm | United States | 9/29/2026 | ◌ Claimed (unverified) |
| LFG Holding | Safepay | — | 9/28/2026 | ◌ Claimed (unverified) |
| First Secure Bank Group | Storm | United States | 9/27/2026 | ◌ Claimed (unverified) |
| Capital Cell Global | Killsec3 | Malaysia | 9/27/2026 | ◌ Claimed (unverified) |
| Cayman National Bank | Killsec3 | Cayman Islands | 9/27/2026 | ◌ Claimed (unverified) |
| DUC App | Killsec3 | Cuba | 9/27/2026 | ◌ Claimed (unverified) |
| Cadorim | Killsec3 | Belgium | 9/27/2026 | ◌ Claimed (unverified) |
| Majani Insurance Brokers | Vexy | — | 9/25/2026 | ◌ Claimed (unverified) |
| Inversiones Bolívar | Qilin | — | 9/24/2026 | ◌ Claimed (unverified) |
| Gold Star Financial | Brain Cipher | United States | 9/23/2026 | ◌ Claimed (unverified) |
| Columbia Bank | Clop | United States | 9/23/2026 | ✔ Confirmed |
| Taspen Life | Lockbit5 | — | 9/22/2026 | ◌ Claimed (unverified) |
| theLender | Termite | United States | 9/22/2026 | ◌ Claimed (unverified) |
| Guardrisk | The Gentlemen | South Africa | 9/21/2026 | ✔ Confirmed |
| The Money Store | Storm | United States | 9/21/2026 | ◌ Claimed (unverified) |
| Siinqee Bank | Lockbit5 | Ethiopia | 9/20/2026 | ◌ Claimed (unverified) |
| ARS Renacer | Dragonforce | Dominican Republic | 9/20/2026 | ◌ Claimed (unverified) |
| STOKR | N0n | Luxembourg | 9/18/2026 | ◌ Claimed (unverified) |
| Argentem Creek Partners | N0n | United States | 9/18/2026 | ◌ Claimed (unverified) |
| Johnson Investment Counsel | Storm | United States | 9/18/2026 | ◌ Claimed (unverified) |
| First Secure Community Bank | Storm | United States | 9/18/2026 | ◌ Claimed (unverified) |
| The State Bank Group | Storm | United States | 9/18/2026 | ◌ Claimed (unverified) |
| First Secure Bank and Trust | Storm | United States | 9/18/2026 | ◌ Claimed (unverified) |
| Optimum First Mortgage | Black Nevas | — | 9/16/2026 | ◌ Claimed (unverified) |
| Partners Financial Services, a.s. | INC Ransom | Czechia | 9/16/2026 | ◌ Claimed (unverified) |
| Insight Credit Union | Storm | United States | 9/14/2026 | ◌ Claimed (unverified) |
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.
Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.