Ransomware leak-site victim claims rose 30% in Q3, but many may be false
- Severity
- Medium
- Sources
- 1
What happened
ReliaQuest reports a 30% rise in leak-site victim listings in Q3 2026, with 43 first-time groups accounting for 93% of the increase, and bulk dumps from groups such as Global Secret Group and crpx0 that suggest pre-collected data. ExfilSquad, first seen July 2026, appears to harvest exposed GitHub credentials and post low-risk employee data with empty fields, so its claims may overstate access. Storm may be a rebrand of Stormous, which is unconfirmed. Defenders should review internal logs, access records and posted samples, rotate any credentials found in code repositories, audit repositories for exposed keys, enforce Microsoft's vulnerable driver block list, and alert on unexpected Group Policy changes. No CVEs are cited.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review internal logs, access records and any posted samples when your organisation is named on a leak site.
- Keep unverified claims marked as unverified and look for other sources of exposure before deciding.
- Audit code repositories for exposed keys and passwords, and rotate any that are found.
- Enforce Microsoft's vulnerable driver block list and alert on unexpected Group Policy changes.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies