Our data desk tracked a surge in unverified ransomware leak-site postings over a single day, with Nightspire leading the activity.
Key points
- Nightspire filed nine of the 31 total claims in the 24-hour window.
- US targets accounted for 10 claims, with healthcare facing six.
- No fixes exist for these unverified criminal group statements.
Ransomware groups are aggressively posting unverified leak-site claims at a higher volume than usual. Our analysis shows 31 distinct claims emerged within a single 24-hour period, signaling increased operational tempo among several criminal outfits.
What happened
Our data desk analyzed public records from the ransomware.live tracker to count active leak-site assertions. In the past 24 hours, we identified 31 separate claims made by various ransomware gangs. Nightspire was the most active group, filing nine of these claims. LockBit5 followed with four claims. BYOD, SilentRansomGroup, Eclipse, Storm, DragonForce, and Qilin each filed two or three claims.
The geographic distribution of these claims shows the United States as the primary target, with 10 claims originating from US-based victims. Brazil saw three claims, while Singapore and Germany each had two. Canada and Haiti each reported one claim. Sector analysis reveals that healthcare organizations were the most frequently cited targets, appearing in six of the claims.
Education and "Other" sectors each accounted for four claims. Professional services made up three claims, and transportation accounted for two. It is critical to note that these are unverified statements made by criminal groups. We deliberately do not report specific victim names to avoid amplifying the attackers' narratives or causing unnecessary harm to the targeted entities.
Why it matters
A spike in leak-site activity indicates that ransomware operators are actively trying to pressure organizations into paying ransoms. When groups like Nightspire post frequently, it suggests they are attempting to create urgency and fear among potential victims. For students and new security professionals, understanding that these claims are often unverified is key. Not every claim results in a public data dump, and many organizations refuse to pay.
However, the volume of claims can overwhelm incident response teams and damage reputations even if no data is actually released. Tracking these patterns helps security professionals anticipate which sectors might be under pressure. In this period, the concentration of claims in US healthcare and education highlights these sectors as current high-priority targets for attackers.
The fix
- Monitor official alerts from your sector’s ISAC for verified breach reports.
- Do not trust unverified leak-site claims as confirmed breaches.
- Maintain offline backups to reduce ransomware leverage.
- Verify any claim internally before taking public action.
What to do and how to stay safe: Nightspire
- Shared credentials allow ransomware to encrypt both live data and backups simultaneously.
- Immutable storage prevents modification or deletion of backup files for a set period.
- Regular restoration tests reveal configuration errors before an actual emergency occurs.
Isolate your backups and enforce immutability to prevent ransomware from destroying your recovery options. Test your restoration procedures regularly to ensure they work when you need them most.
Step-by-step guide: Ransomware Backups: 8 Practices to Survive an Attack
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many ransomware claims were recorded in 24 hours?
Our data desk counted 31 ransomware leak-site claims in a 24-hour period.
Which ransomware group was most active?
Nightspire was the most active, filing 9 of the 31 claims.
Which country was targeted the most?
The US was the most targeted country with 10 claims.
