Ransomware gangs have claimed 278 victims on leak sites so far in November 2026, according to tracking data updated on 9 November, with the group known as N0n responsible for 50 of them.

The figures, compiled by HackerFeeds from ransomware.live leak-site monitoring, cover claims published through 9 November. They compare with 1,147 victims claimed across the whole of October, although the November total is partial and will keep changing as new claims are posted.

Three groups account for more than a third of the month's claims so far. N0n leads with 50 victims, or 18 per cent of the total, ahead of Qilin with 26 and The Gentlemen with 25. Together the three groups account for 36.3 per cent of all victims claimed this month. N0n claimed 154 victims in the whole of October.

Manufacturing is the most targeted sector, with 43 victims, or 15.5 per cent of the month's total, ahead of professional services with 31 and technology with 29. Healthcare accounts for 20 victims and retail and e-commerce for 19.

Organisations in the United States account for 100 of the victims claimed, or 36 per cent, followed by Germany with 22 and the United Kingdom with 13. Canada recorded 12 victims and Brazil 10, while 45 victims did not disclose a location.

Three groups appeared in the tracking data for the first time this month: PixelLeaks, whose first victim was recorded on 3 November, Destello, also first seen on 3 November, and Aoqin, first seen on 4 November. The trackers note that a group appearing for the first time may have operated earlier under another name.

The busiest day so far was 4 November, when 66 victims were claimed, while the quietest was 1 November with 18. Victims were posted on all nine days of the month covered by the data.

Among the latest claims, Expedia Group was listed by N0n on 9 November, and Grupa ABS was listed by a group tracked as Panzer the same day. Both are claims published on the groups' leak sites and have not been independently verified.

That caveat matters. A leak-site listing is a claim by the criminal group itself, and it does not confirm that an attack took place or that data was stolen. Only the named organisation or its regulator can confirm a breach, and some listings turn out to be duplicates or to recycle older incidents.

Separate monitoring by Blacknote Intelligence recorded 17 new victims claimed on ransomware leak sites in the 24 hours to 02:00 UTC on 9 November, across nine active groups, and put its live cyber threat level at 35, described as guarded.

The November pace underlines how routine leak-site claims have become. With 42 groups posting at least one victim in nine days, defenders face a wide field of attackers rather than a single dominant threat, and the most targeted organisations are manufacturers and service firms rather than only large technology companies.

Security teams are advised to treat leak-site claims as a prompt to check their own exposure, not as confirmed incidents, and to keep offline backups and incident response plans tested. The November figures will be updated as the month continues.