Majinahanashi's pending Jons Civil Engineering Company Ltd. (JCEL) post moves from PENDING to published by the end of 29 October 2026, in line with its stated 28 October schedule.
Called Mon 26 Oct · due Thu 29 Oct
No JCEL listing status (published or still pending) visible in today's feed items; due date is today 29 October.
partly
Qilin will post at least ten further leak-site victim claims to ransomware.live between now and 2 November.
Called Tue 27 Oct · due Mon 2 Nov
Qilin posted at least 2 claims visible in today's feed (Hawaii Law Enforcement FCU, NuVista FCU) but tempo signal notes 39 Qilin claims in last 7 days, strongly suggesting ≥10 new claims since 27 Oct; due date 2 November not yet passed so cannot fully settle.
No named, non-honeypot organisation will be publicly reported in these feeds as successfully compromised via CVE-2026-109618 or CVE-2026-109619 by 4 November.
Called Wed 28 Oct · due Wed 4 Nov
China-linked actors exploited PHP2Shell (CVE-2026-109618/19) and rooted firewalls including breaching a US government-affiliated network, and CISA confirmed active exploitation, but no specific named non-honeypot victim organisation was publicly attributed by name in these feeds; due date 4 November not yet passed.
Booba Project will post at least five further leak-site claims across ransomware.live or ransomlook by 4 November.
Called Wed 28 Oct · due Wed 4 Nov
Booba Project posted at least 8 named victim claims on 27 October alone (Hudson River Museum, BASS Medical Group, Kerckstede vzw, RCOA, Charter Township of Commerce, KING FAMILY MEDICAL, City of Big Spring, Aesthetic Specialty Centre), exceeding the threshold of 5 by 28 October.
right
NVD items timestamped after 2026-10-27T01:31 will appear in our feed by 31 October, confirming the silence was an ingestion boundary rather than a halt at the source.
Called Wed 28 Oct · due Sat 31 Oct
NVD items with timestamps from 2026-10-25 and 2026-10-26 appear in today's feed, confirming the silence was an ingestion boundary, not a source halt.
UpTransportation — 2.2× its own prior share (71 claims, 33 expected)
UpEducation — 1.9× its own prior share (51 claims, 26 expected)
UpEnergy & Utilities — 1.6× its own prior share (38 claims, 25 expected)
UpHealthcare — 1.4× its own prior share (114 claims, 81 expected)
22% of claims carry no sector label.
Brand churn
Of the 229 leak-site brands first seen since 2021-09-30, 76% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 68% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 212 old enough to judge posted on one day and never again; 39% made at least half their claims in their first week. New brands this month: 9 — newest: Whitearmor (2026-10-23, 15 claims), Mimori (2026-10-20, 2 claims), THE SEVEN DEADLY SINS (2026-10-16, 8 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 34% of its claims on Germany (6.6× every other brand's share); N0n put 34% of its claims on Transportation (7.5× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.4 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 64% of its claims on Mondays, half of them in 19:00–19:59 UTC; akira posted only 1 of 196 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 36% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers