September's Ransomware Index: The Victims One Group Tried to Hide

Bottom line: 956 victim listings from 79 groups in September 2026, and ranking them by volume is the least useful thing you can do with that. These groups differ in how they treat the victim's name — publish it, redact it, or hold it back as leverage — and that single choice tells you more about the threat than any count.

The mask comes off

audit team posted 35 listings, every one labelled "AUDIT ENTITY" rather than a company. Twenty-one were partially redacted: De***up, pa***op, Wi***IT, dg***kr.

The redaction is leverage. The name stays hidden while the victim is still talking and goes up when they stop. Both versions end up on the leak site, and we hold both — so pairing the redacted listings against the group's own later unredacted ones resolves 14 of 19 distinct entities:

• De***up → Demidov Steel Group

• Wi***IT → Wise IT

• Pr***IT → ProMind IT

• TE***PB → TEK SPB

• ma***up → mansurovogroup

• pa***op → palletshop

• st***co → steelco

• bu***en → buben

• kr***rg → krimax.org

• go***et → gownet.net

• PI***al → PIT.local

• dg***kr → dg.ac.kr

• ki***jp → kit-e.jp

• vi***in → vit.ac.in

Two are universities, one Korean and one Indian. Five entities stay masked, and we are not resolving those: a listing still under a mask means the pressure is still being applied, which is the only state in which anything useful can be done.

That is the operational value here. If you or a supplier appear as a masked entity, you are inside the negotiation window rather than past it — the point where response, insurers and counsel still have moves.

The mask and what was behind it. The group published both.

Clop's twenty-five

Clop listed 25 organisations, named by domain in its house style: HARLEY-DAVIDSON.COM, AMEY-CO.UK, TRANSPORT-NSW.GOV.AU, KIRKLAND-AND-ELLIS.LLP, COLUMBIABANK.COM, BRINKS-CO.NZ, ALDOGROUP.COM, SUUNTO.CN, PALIG.COM, SAUL-ORG.UK, UNISALLE-EDU.CO, INFINIGATE.CH, CCED-COM.OM, DAD-CO.TH.

A UK infrastructure contractor. An Australian state transport authority. One of the world's largest law firms. A US regional bank, a cash-handling operation in New Zealand, a Canadian footwear retailer, a Finnish watch brand, a Pan-American insurer, a UK university pension scheme, a Colombian university, a Swiss distributor, an Omani engineering firm, a Thai state developer.

Nothing connects them. Not sector, not region, not any adversary interest that would explain picking these 25. We assess with moderate-to-high confidence that the set comes from mass exploitation of one shared third-party platform rather than 25 separate intrusions — the pattern this group has repeated for years. We are not naming a product, because we have the victim set and not the vector, and those are different evidence.

The implication holds without the product name: your exposure is a supplier's patch cycle, not your perimeter. Know who owns your internet-facing managed file transfer and edge appliances, and know who patches them.

Two listings, two major targets

fulcrumsec posted twice. The names were Manchester Airports Group and Dustin Group, a Nordic IT reseller.

By volume that group ranks near the bottom of all 79. The volume leader, the gentlemen, posted 106 listings, mostly mid-market, with Veradigm, the University of San Francisco, Hollard Insurance Group and Leo Schachter Diamonds as the recognisable exceptions. Listing count does not predict target size, and a watchlist ordered by volume would have had fulcrumsec nowhere near the top.

A group's entire September output — and both names outrank most of what the volume leaders posted.

Claimed twice

Two organisations show up under two different groups.

eTeam was listed by endzone, then again by byod, whose own listing text states that eTeam "was informed they had been breached, just ignored us." Telrad Networks was listed by qilin and by the gentlemen.

A second claim can mean a fresh intrusion. It can also mean the same access was resold to another affiliate, or that old data is being recycled for a second attempt at payment. Whichever it is, the first response did not close the exposure.

Telrad Networks, claimed by two separate groups.

storm's chosen profile

storm reached 66 listings with an unusually coherent victim set: Pinnacle Hospital, WindRose Health Network, Rood & Riddle Equine Hospital, The Cecilian Bank, City of Mitchell, Valor Defense Solutions, Star Aviation, American Contractors Insurance Group.

Community healthcare, small banks, municipal government, defence-adjacent manufacturing, almost entirely US. Organisations with genuine downtime costs and thin security staffing. That is selection, not opportunism, and it means a sub-500-seat provider in any of those categories sits inside this group's target set regardless of where it ranks by volume.

Rural healthcare and a defence supplier, from the same group's roster.

The tail

Ten groups account for half of all September listings. Fourteen posted a single victim each. Working the far end, krybit and safepay list almost exclusively by domain and almost exclusively small international businesses — jswlaw.bt, orex.co.th, vit.ac.in, hbpro.pt, cenmar-manila.com, reichenau.at. Thirty-five listings with no recognisable name is not a lesser threat. It is a threat to a different customer.

Actions

• Check audit team's masked entities against your supplier list. A mask means a live window.

• Inventory internet-facing file transfer and edge appliances, and establish who patches them.

• Treat any second listing as an open incident. eTeam and Telrad both show a first response that didn't end it.

• Order your watchlist by victim profile, not group volume. storm is more relevant to a community hospital than the month's volume leader.

Outlook

Redaction works: it applies pressure without surrendering the threat, and it costs the group nothing. The gap between what a group has named and what it actually holds is where the risk now sits. The useful question about any group has stopped being how many victims it has listed. It is which ones it hasn't.