United Kingdom
United Kingdom Infostealer Threat Report — February 2026
02/01/2026 – 02/28/2026
Threat summary
Key figures from the month's threat activity.
Overview
Most common malware family: VIDAR (43.7% of infections). Sector with the most employee account leaks: Education. Leaked accounts fell by 25.1% compared with the previous month.
Ransomware victims in United Kingdom5,529
infected devices · from 10 families
Report periodFeb 1, 2026 - Feb 28, 2026
Risk score
37-13vs previous month
- Infected devices
- 5,529
- Android devices
- 1,846
- Domains
- 45,153
- Employee accounts
- 1,401
- Customer accounts
- 255,502
- Families
- 10
Top 10 malware families
infections- 1VIDAR2,414
- 2PUREV4781
- 3STEALC581
- 4MACSYNC STEALER426
- 5LUMMAC384
- 6UNKNOWN272
- 7ARKEI147
- 8REDLINE136
- 9REMUS125
- 10SANTA STEALER54
The full list is in the PDF reportDownload report
Top 10 antivirus
infected devices- 1Windows Defender2,344
- 2Bitdefender16
Breakdown of leaks
Breakdown by sector, file type and critical system.
Employee accounts by sector
organizationsrecordsRansomware victimsemployee accounts- 1Education117organizations15.2Krecords1Ransomware victims332employee accounts
- 2Technology33organizations63.3Krecords9Ransomware victims63employee accounts
- 3Telecommunications4organizations2.0Krecords–Ransomware victims33employee accounts
- 4Retail and e-commerce7organizations22.4Krecords–Ransomware victims31employee accounts
- 5Finance6organizations10.7Krecords1Ransomware victims17employee accounts
- 6Entertainment and lifestyle1organizations2.4Krecords–Ransomware victims15employee accounts
- 7Gaming and betting5organizations12.1Krecords–Ransomware victims13employee accounts
- 8Government6organizations7.6Krecords–Ransomware victims12employee accounts
- 9Healthcare7organizations1.9Krecords1Ransomware victims11employee accounts
- 10Nonprofit2organizations2.4Krecords–Ransomware victims7employee accounts
The full list is in the PDF reportDownload report
Report contents
Sections and pages of the full report.
Contents
Download the reportPreparing contents
Other reports
From the Essential plan
Infostealer Detection
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.