Ransomware crews posted 1,127 victims on their leak sites in October 2026, a 25.8% jump from 896 in September, according to the HackerFeeds monthly report dated 31 October. The count makes October the busiest month of the autumn on that tracker, with 79 active groups, 7 brand-new brands and a single-day peak of 73 claims on 26 October. Three crews carried the load: N0n, The Gentlemen and Qilin.

Those headline numbers need a warning label. A leak-site claim is not a confirmed breach, and trackers disagree with each other by double digits, because they count different things. HackerFeeds tallies leak-site claims, while other trackers use their own sourcing or smaller confirmed-attack series, so the same month can produce different totals depending on the method. The trend is still clear on a like-for-like basis, but the absolute figure should not be read as a count of confirmed intrusions.

A claim disputed by its target

The gap between a claim and a confirmed breach is visible in one of October's most prominent incidents. A group calling itself BYOD claimed it had compromised 36,000 systems at the University of New Mexico Health Sciences Center on 26 October, a figure that comes from the attackers alone. The university calls the incident a cybersecurity event, says core systems and servers were not penetrated, and restored its critical electronic systems by Tuesday afternoon, after an attack that had diverted ambulances and cancelled surgeries and classes.

For defenders, the lesson is twofold. The volume of claims is rising, and the busiest crews are active across healthcare, manufacturing and other sectors, so patching, credential hygiene and incident response planning matter more, not less. At the same time, a listing on a criminal leak site should be treated as an allegation until the company, a regulator, law enforcement or independent researchers confirm it.