Ransomware groups posted 7,655 victim claims across 141 countries from March 2025 to March 2026, averaging one new organization named every 71 minutes. The data from CipherCue's ransomware.live API shows 129 active groups, with the top five accounting for 40% of claims. Qilin led with 1,179 claims across 74 countries, while US organizations faced 40% of all attacks.

Manufacturing and technology sectors bore the brunt, with 890 and 843 claims respectively. The ecosystem shows remarkable fragmentation - even removing the top group wouldn't significantly reduce overall volume. Geographic distribution reveals SafePay's unusual concentration on German targets (72 claims) compared to other groups' broader spread. Canada and the UK saw more distributed targeting across multiple groups.

Volume increased 40% in the second half of the observation period, rising from an average of 521 monthly claims to 732. December 2025 saw the highest activity at 861 claims. This sustained increase suggests ransomware activity isn't declining but evolving, with supply chain risk particularly acute for manufacturers and technology providers who together account for 35% of sector-attributed claims.