Global, October 2026: infostealer infections, leaked accounts and ransomware incidents

An assessment based on Dark Radar intelligence data. Infected devices, leaked corporate and customer accounts, active malware families and the targets of ransomware groups in a single report.

Why this report matters

Infostealer infections are often the first step in account takeover and ransomware attacks. The report sets out the infections and leaked accounts observed during the month by sector and domain, so security teams can decide which accounts and systems to address first.

What the report covers

• Infostealers on 236,043 devices and the distribution of 27 malware families
• 58,881 leaked employee and 10,736,726 customer accounts by sector and domain
• 1,846,379 domains seen in leaks and their extension classes
• 1,234 ransomware incidents, the most active groups and the sectors they targeted