Ransomware gangs attacking India
Every ransomware group that has posted at least 5 Indian organisations on its leak site, ranked by activity in the past 12 months. Together they account for 417 of the 561 Indian victims posted since records began.
| Group | Past 12 months | All time |
|---|---|---|
| The Gentlemen | 33 | 36 |
| Krybit | 12 | 12 |
| Sinobi | 12 | 12 |
| NightSpire | 11 | 13 |
| LockBit 5.0 | 9 | 9 |
| Cl0p | 8 | 19 |
| Qilin | 8 | 15 |
| DragonForce | 8 | 9 |
| KillSec | 7 | 50 |
| Vexy | 6 | 6 |
| INC Ransom | 5 | 8 |
| Blackshrantac | 5 | 8 |
| Everest | 5 | 6 |
| Tengu | 5 | 5 |
| World Leaks | 4 | 7 |
| Nova | 4 | 5 |
| BlackNevas | 3 | 5 |
| RansomHouse | 2 | 5 |
| Lynx | 2 | 5 |
| LockBit 3.0 | 0 | 41 |
| FunkSec | 0 | 23 |
| RansomHub | 0 | 19 |
| BianLian | 0 | 12 |
| Babuk2 | 0 | 10 |
| DarkVault | 0 | 10 |
| Dragon Ransomware | 0 | 10 |
| 8Base | 0 | 9 |
| ALPHV | 0 | 9 |
| Medusa | 0 | 8 |
| Akira | 0 | 8 |
| APT73 | 0 | 7 |
| Dispossessor | 0 | 6 |
| Snatch | 0 | 5 |
| Cryp70n1c0d3 | 0 | 5 |
Leak-site counts from ransomware.live’s public data for victims with country India, as of 16 Oct 2026. A post is a claim made by a criminal group, not a confirmed breach, and the real number of attacks is higher. Victims are never named on this site. See the method.