The Ransom Index
A daily measure of ransomware leak-site activity, weighted by the rough economic size of the sectors hit. 100 is its Q3 2026 average.
Index
117
Against Q3 2026
+17%
Change on week
−5 pts
95% band
102–132
On 8 November 2026 the index stood at 117, 17% above its Q3 2026 average. Since July it has spent most of its time between 79 and 130, so today's reading is within its usual range.
Since July 2026
Line: index, seven-day average. Shaded: 95% band from claim-count uncertainty. Dashed: 100. We start the public chart in July because our collection was still ramping up before then.
Which sectors moved
| Sector | Claims, last 7 days | Previous 7 days | Weight |
|---|---|---|---|
| Manufacturing | 43 | 34 | 1.5 |
| Professional Services | 29 | 37 | 1.0 |
| Technology | 27 | 32 | 2.0 |
| Healthcare | 20 | 27 | 1.5 |
| Retail & E-Commerce | 18 | 19 | 1.0 |
| Financial Services | 15 | 13 | 2.5 |
| Transportation | 8 | 12 | 1.4 |
| Education | 7 | 16 | 0.5 |
| Hospitality | 7 | 3 | 0.8 |
| Government & Defense | 5 | 10 | 1.3 |
| Agriculture And Food Production | 4 | 2 | 1.0 |
| Energy & Utilities | 3 | 12 | 3.0 |
Which groups moved
| Group | Claims, last 7 days | Change on prior week |
|---|---|---|
| N0n | 49 | +44 |
| Qilin | 16 | -29 |
| TheGentlemen | 25 | -25 |
| MedusaLocker | 18 | +18 |
| Booba Project | 4 | -13 |
| BrainCipher | 12 | +12 |
| Akira | 17 | +11 |
| whitearmor | 4 | -10 |
How it is built
Each day we take the last seven days of claims on ransomware leak sites, multiply each sector's count by a published weight for that sector's rough economic size, and compare the total with its Q3 2026 average. The weights are stated assumptions, not measured losses, and we publish them so you can disagree.
| Sector | Weight |
|---|---|
| Energy | 3.0 |
| Energy & Utilities | 3.0 |
| Finance | 2.5 |
| Financial Services | 2.5 |
| Technology | 2.0 |
| Telecommunications | 2.0 |
| Healthcare | 1.5 |
| Manufacturing | 1.5 |
| Transportation | 1.4 |
| Government | 1.3 |
| Government & Defense | 1.3 |
| Construction | 1.1 |
| Professional Services | 1.0 |
| Retail | 1.0 |
| Retail & E-Commerce | 1.0 |
| Hospitality | 0.8 |
| Education | 0.5 |
| Non-Profit | 0.4 |
Weights v1.1 (2026-11-09: sector names aligned to the graph's labels). Any sector not listed has weight 1.0.
What it can't tell you
- Claims as discovered by public trackers, not confirmed breaches; discovery lags the attack.
- Sector weights are STATED PRIORS of rough relative firm size, not measured losses - the table ships in this payload.
- The index measures claim ACTIVITY weighted by rough economic size; it is not a loss estimate.
- Victims who pay before publication never appear; all figures are floors.
- Our collection was thin before July 2026, so we do not compare with earlier periods.
- One group posting a backlog can move the index by itself: check the table of groups above.
Cite it
Ninja Labz, "The Ransom Index", reading for 8 November 2026. https://ninjalabz.io/ransomware/ransom-index. CC BY 4.0.
Download the data (JSON) · Most active groups · All groups
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archive