The DeadLock ransomware group listed five new alleged victims on its leak site on 8 November 2026, in a busy day for ransomware claims that took the month's total to 270 organisations named by criminal groups.

Threat intelligence tracker ThreatMon reported that DeadLock added Kadick, a United States-based organisation, to its victim list on 8 November. The same feed also recorded a separate claim by LockBit 5.0, which listed Starmark, a manufacturing organisation based in Thailand, on the same day.

Figures compiled by HackerFeeds from the ransomware.live tracker show that DeadLock named four further victims on 8 November: Fidex in Mexico, NoseTea in the United States, Coopebis in Costa Rica and Trinity Custom Homes in the United States. Fidex is a Mexican insurance broker and risk management advisory firm founded in 2002, and the listing was discovered at 19:51 UTC. Coopebis operates in agriculture and food production in Costa Rica.

None of the claims has been independently verified. ThreatMon's reports give no details of how any of the organisations was supposedly breached, which systems were affected, or what data, if any, was taken. HackerFeeds is equally clear that a leak-site listing is a claim by the criminal group itself and does not confirm that an attack took place or that data was stolen.

That caution matters because leak-site claims are sometimes exaggerated or wrong. Groups use the listings to pressure victims into paying, and a name appearing on a leak site is the start of an investigation, not proof of a breach. Until a victim confirms an incident, forensic evidence appears, or stolen data is independently examined, each of these five cases should be treated as an unconfirmed claim.

DeadLock is a double-extortion ransomware operation that emerged in mid-2025. Researchers note that it encrypts victims' systems and threatens to publish stolen data, and that no public decryptor exists for its encryption. The group negotiates with victims over the Session messaging network, according to threat intelligence profiles.

The wider picture shows ransomware activity running at a high pace in November. HackerFeeds recorded 270 victims claimed on leak sites so far in November, through 8 November, compared with 1,147 across the whole of October. Forty-one groups have posted at least one victim this month, with N0n the most active at 49, followed by Qilin with 26. DeadLock accounts for six victims in November so far, about 2.2 per cent of the total.

Manufacturing remains the most targeted sector, with 41 victims, or 15.2 per cent of the month's total, ahead of professional services with 31. Organisations in the United States account for 97 victims, or 35.9 per cent, followed by Germany with 21 and the United Kingdom with 13.

Security teams are advised to watch for further disclosures about the five organisations, including any company statements or samples of allegedly stolen data. A listing is often followed within days by either a ransom deadline or a data leak, but it can also sit unsubstantiated. Organisations should check that backups are tested, that remote access is protected with multi-factor authentication, and that incident response plans are ready to use.

The five claims add to a November that has already seen several high-profile ransomware stories, and they underline how quickly new victim names appear. For now, though, the only established facts are the listings themselves and the dates they appeared.