Ransomware Claims Against Australian Organisations

Ransomware groups have posted 550 Australian organisations on their leak sites, by 112 different groups. 506 of those are from 2023 onward, when the tracker's systematic coverage begins; the 44 listings before that are historical cases going back to 2016. 170 were posted in the last twelve months, 13% more than the 150 in the twelve before. The typical month brings 14.5 claims, and the busiest in the last two years was April 2026 with 20.

Every row on this page is a claim made by a criminal group on its own site, recorded by the public tracker ransomware.live. Nothing here is verified. Groups list organisations they never breached, list them during negotiations, and get names and countries wrong. Where we have written a brief on a listing it says "claims" for that reason, and so does this page.

Claims per month

Who is posting now

20 groups posted an Australian organisation in the last 90 days, 45 claims between them against 44 in the 90 days before. 14 of them had not posted an Australian victim in the quarter before that. The most active this quarter is qilin with 10 claims. This is the present tense, not a forecast: which group posts next depends on whose affiliates compromised whom months ago, and the sequence of Australian posts does not predict it.

Over the whole file, 46 groups have posted exactly one Australian organisation and never returned. The groups that keep coming back are few:

Sectors, last twelve months

Of the 170 organisations posted in the last twelve months, the tracker could place 159 in a sector and 11 it could not. Professional Services leads with 20.8% of the classified claims. For an Australian business the question this answers is not "am I a target", which every sector is, but how often organisations like yours have been posted lately.

• Professional Services 33 · 20.8%
• Retail & E-Commerce 29 · 18.2%
• Healthcare 19 · 11.9%
• Manufacturing 16 · 10.1%
• Technology 16 · 10.1%
• Financial Services 8 · 5%

The latest claims

The 15 most recent, newest first. 13 listings have a brief, written from the listing alone and worded as the claim it is.

What this page can and cannot say

• Claims, not breaches. A listing means a group said it has an organisation's data. Some listings are true, some are exaggerated, some are false, and this page cannot tell which. It reports what was posted.
• The country is inferred. The tracker tags a victim's country from its website and public records, and gets it wrong sometimes; a Canadian law firm has sat in the Australian file. The counts here carry that error.
• Dates are when the tracker saw the post. A group may have posted days earlier, and the incident itself is usually weeks or months before that.
• Groups rename and reorganise. A group that "disappears" from the table has often reappeared under another name, and a "new" group may be an old one's affiliates. The tables use the names the tracker uses.
• No forecast. Which group posts the next Australian victim is not predictable from this data, and the page does not try. A rate is a fact; a prediction would be a guess with a decimal point.

Method

The source is ransomware.live's public API, its file of every victim tagged Australian, which our news worker reads every three hours for its own leak-site feed and caches. This page reads that cache and computes every figure above at request time, so the numbers and the sentences describing them can never disagree. Months are counted by the tracker's discovery date. The file holds a few listings from before the tracker existed, added by hand; the page counts them but dates its coverage from the first year with at least 50 listings. A sector the tracker could not determine is counted but never ranked. The page is cached for fifteen minutes.