What the Leak Site Date Actually Shows

October 22, 2026

Leak site postings from ransomware groups are more than victim tallies, their cadence reveals which operators are running active intrusion pipelines right now. This blog looks at the surge in postings during the week of September 1–9, 2026, sets it against the broader 2026 trend toward consolidation among a handful of dominant groups, and outlines why continuous leak site monitoring matters more than periodic threat reporting.

The Pattern in the Postings

The majority of ransomware groups run a public leak site, usually consisting of a countdown page listing victims who haven’t paid, used as leverage. Track those postings over time and a pattern emerges that’s more useful than any single breach headline: cadence.

In the first week of September, two groups made that pattern obvious. INCRANSOM posted 11 new victims in five days across eight countries, hitting manufacturing and industrial targets hardest, with healthcare and a US school district also on the list. THEGENTLEMEN posted 5 victims in the same window, a Canadian airline among them, at a steady rate of roughly one per day, spanning transportation, healthcare, and technology. A smaller player, Audit Team, added four more across South Korea, Germany, and Argentina. Across all tracked groups, one weekly count put total disclosures at 195 victims from 46 active operators in that single week.

That’s not noise, it’s throughput. A group posting a victim a day isn’t landing lucky hits, it’s running an intrusion pipeline with enough compromised footholds queued up to feed a leak site on schedule. That’s the kind of signal only visible if someone is watching leak sites continuously rather than reacting after a name makes headlines.

The Bigger 2026 Story: Consolidation

Zoom out and the weekly spike sits inside a larger trend. Ransomware disclosures have run 646 to 808 victims a month all year, and 2026 is pacing toward roughly 8,660 total victims, a 24.9% increase over the prior 12-month period.

But the field isn’t getting more crowded, it’s getting more concentrated at the top. The 10 most active groups accounted for 71.1% of all victims in Q1 2026, up from 57% just two quarters earlier. Qilin held the number one spot for five straight months before TheGentlemen overtook it in June with 94 victims that month; Akira racked up 194 victims in Q1 alone; LockBit, still the all-time leader with 500-plus confirmed attacks since 2019, posted its strongest month of the year in June with 43.

Why It Matters for Threat Intelligence

The practical read for security and fraud teams: a handful of operators now drive most of the risk, and their output is fast enough that quarterly threat reports are already stale by the time they land.

Leak site postings are dark web infrastructure in the most literal sense, the same channel where stolen data, access, and credentials get sold. Monitoring it continuously is what turns “we heard a group is active in our sector” into “here’s who’s posting, how fast, and whether we’re already named.”

Don’t miss any updates from DarkOwl. Follow us on LinkedIn.