Ransomware Intelligence / Sectors / Professional services

Sector

Ransomware in Professional services

Law, accounting, consulting, staffing and other business services.

  • 46claims, 7 days
  • 163claims, 30 days
  • 458claims, 90 days
  • 2026-10-17most recent claim

Leak-site listings are claims made by criminals, not confirmed incidents. Sector is assigned from the public listing with an automated classifier and a confidence score; 13% of claims in the last 30 days are not yet classified. If a classification looks wrong, tell us.

Activity, last 26 weeks

New leak-site claims per week against professional services organisations.

Week of 2026-04-20: 0Week of 2026-04-27: 0Week of 2026-05-04: 0Week of 2026-05-11: 0Week of 2026-05-18: 0Week of 2026-05-25: 0Week of 2026-06-01: 0Week of 2026-06-08: 0Week of 2026-06-15: 0Week of 2026-06-22: 0Week of 2026-06-29: 0Week of 2026-07-06: 0Week of 2026-07-13: 2Week of 2026-07-20: 19Week of 2026-07-27: 23Week of 2026-08-03: 50Week of 2026-08-10: 37Week of 2026-08-17: 45Week of 2026-08-24: 44Week of 2026-08-31: 36Week of 2026-09-07: 19Week of 2026-09-14: 31Week of 2026-09-21: 39Week of 2026-09-28: 32Week of 2026-10-05: 43Week of 2026-10-12: 40
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Most active groups, last 90 days

  1. qilin 58
  2. the gentlemen 41
  3. leakeddata 25
  4. akira 21
  5. coinbase cartel 19
  6. lockbit5 17
  7. inc ransom 15
  8. SilentRansomGroup 15
  9. storm 12
  10. safepay 10

Countries, last 90 days

  1. United States 213
  2. Germany 30
  3. United Kingdom 28
  4. Unknown 25
  5. France 18
  6. Italy 14
  7. Canada 11
  8. Spain 10
  9. Brazil 8
  10. India 8
  11. Sweden 8
  12. Switzerland 7
  13. Australia 6
  14. Mexico 5
  15. Netherlands 5

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog is not sector-specific; if you run the product, patch it.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Weekly brief

Weekly briefs cover manufacturing, critical infrastructure and K-12 education today. Subscribe to one of those, or write to info@securitysnares.com if you would read one for professional services.

Request a conversation

Other sectors

Data sources

  • Source: CISA KEV
    updated 2 hours ago
  • Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.
    updated 2 hours ago
  • Source: RansomLook
    updated 2 hours ago
  • updated 2 hours ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.
    updated 2 hours ago

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.