Ransomware Leak Site Postings Surge 30%, But Many Claims May Be Fabricated
Ransomware leak site postings saw a 30% increase in Q3 2026, largely driven by new, unproven groups whose claims may be fabricated, according to researchers.
The number of organizations appearing on ransomware leak sites surged by 30% in the third quarter of 2026. However, cybersecurity analysts caution that this dramatic increase does not necessarily reflect a proportional rise in actual ransomware attacks. Much of this growth is attributed to new and unproven ransomware groups, some of which exhibit suspicious posting patterns that suggest their claims may be fabricated or based on recycled data.
Leak sites serve as a primary tool for ransomware gangs to publicly name and shame victims, thereby increasing pressure for ransom payments. Historically, these postings have been used by defenders to gauge the scale of ransomware activity. While fake or recycled claims are not a new phenomenon, with past instances showing old data being presented as a fresh breach, the current quarter appears to show a more significant problem.
Analysts at ReliaQuest observed that 43 groups that had never posted before the third quarter were responsible for 93% of the increase in victim listings. In contrast, groups active in both the second and third quarters only added 1% more named organizations. This disparity suggests that the surge is not indicative of established threat actors expanding their operations, but rather the emergence of potentially less legitimate entities.
The posting behaviors of these new groups vary considerably. Some maintain a steady weekly cadence, while others engage in bulk dumps of victim names, often within a single day. For example, a group identified as "Global Secret Group" listed 48 victims, with 28 appearing on the same day. Similarly, "crpx0" listed 47 victims in a single day before ceasing posts in August. While bulk releases do not definitively prove a claim is false, they are more consistent with pre-collected data than with numerous individual, successful breaches.
Some new groups, however, exhibit patterns that resemble more legitimate operations. "Storm," for instance, listed 71 victims over 20 days, surpassing established names like DragonForce and LockBit in victim count during that period. Intriguingly, "Storm" began posting approximately five weeks after a similarly named group, "Stormous," made its final post, raising the possibility of a rebrand, though this remains unconfirmed.
A particularly clear example of a dubious claim comes from "ExfilSquad," which emerged in July 2026. This group released data samples containing employee names, email addresses, and phone numbers, alongside empty fields and basic customer relationship details. ReliaQuest noted that this data is low-risk personal information and does not substantiate a network breach. It is more likely that the group scanned GitHub for exposed credentials and accessed only the data available through those limited accounts, using a ransomware-style leak site to inflate the perceived severity of the breach.
Given the prevalence of potentially fabricated claims, researchers strongly advise treating all leak site postings as unverified until independently confirmed. The potential harm from such claims can range from wasted resources investigating false positives to targeted phishing attacks against listed employees. Ignoring a real claim, conversely, can lead to significant data exposure and subsequent security incidents. Defenders are urged to meticulously review internal logs, access records, and any provided data samples to validate claims and initiate incident response only when evidence of a genuine intrusion is found.