The SINON Ransomware Index, August 2026
1,223 leak-site listings across 82 ransomware groups in August 2026. Qilin and The Gentlemen finished two posts apart, five crews accounted for 42% of the month, and three of the numbers people expect from a monthly index are missing on purpose.
First issue. This is a count of what ransomware crews put on their own leak sites during August 2026, taken from SINON's own collection.
1,223 listings, 82 groups, thirty-one days. these are criminal adverts, and the people writing them lie about volume for a living.
Who posted
Qilin ended the month on 165. The Gentlemen ended on 163. Two posts apart after thirty-one days, and no obvious reason either should have come out ahead.
Clop took third with 87, which is most of the distance to the pair above it. Then Coinbase Cartel at 49, Orova at 44, INC Ransom and Direwolf level at 43.
Five groups produced 508 listings between them, 42% of the month. Ten produced 702.
Ten groups posted once and then nothing. Some of those are new sites finding their footing. Some are the last post a crew ever makes.
We index 621 groups and had 167 of them responding as this was written. Eighty-two posted anything at all in August. Most leak sites are just sitting there, which is worth remembering whenever a tracker quotes the number of groups it follows.
Day to day
The mean was 39.5 a day and the mean is not much use here. The 12th brought 101 listings, the 5th brought 98, and plenty of days sat in the teens.
Ignore the 1st. It shows one listing, with 62 on 31 July before it and 36 on the 2nd after it. That is a scraper that stopped. It is greyed in the chart so nobody reads a trend into it.
Batch posting explains most of the rest. A negotiation window closes and a crew empties its queue. But these timestamps record when we saw a post, not when the group published it, so a spike can just as easily be a site that went dark on Tuesday and came back Friday with a backlog.
Method
Everything above is counted from our August 2026 archive, pulled on 13 September. One listing is one post on one group's site. Dates are our discovery timestamps. Group names are spelled as the sites spell them.