Security Navigator 2027 · Cy-X
More Extortion Gangs Than Ever – And One Rules Them All?
Security Navigator 2027 launches in:
days
hours
minutes
seconds
We have tracked the leak sites of every active extortion group since 2020. The Security Navigator 2027 maps who is behind the attacks, who gets hit – and where in Europe the gangs are moving.
Quick quiz: Which European country saw extortion victims grow fastest?
Be among the first readers of the Security Navigator 2027!
Be among the first readers of the Security Navigator 2027!
Be among the first readers of the Security Navigator 2027!
Be among the first readers of the Security Navigator 2027!
What is visible of the extortion economy?
Leak sites are where extortion gangs publish the victims who refuse to pay. Our security research team tracks them across every active group – and from that data show which gangs set the pace, which organizations end up on the lists and how the map of Europe is shifting.
How we counted
We record victims that extortion groups publish on their leak sites, for October 2025 to September 2026. It is a partial view of cybercrime – it misses victims who pay quietly – but a useful and objective proxy for trends. The chapter also compares where victims are posted with where you would expect them, given the size of each economy.
Answers you will find in the Navigator?
- Was 2026 already a record year after just nine months?
- Which European countries saw victims grow fastest?
- Small, medium or large – which organizations do extortion gangs prefer?
- Which groups set the pace – and which familiar names are losing ground?
- Which countries are hit more – or less – often than their economies would predict?
The visible extortion economy grew rapidly, but it is not confined to one industry, one country or one organisation size.
– Carl Morris, Senior Security Researcher
Take it to your team
- Would we know within hours if our data showed up on a leak site?
- Which of our suppliers would hurt us most if they were extorted?
- Is our ransomware playbook built for encryption only – or also for data theft without encryption?
- Who decides – and how fast – if our name appears on a leak site?
- Does our board know which groups are active in our industry?
Explore some other questions:
Can a fake protest movement target your brand? → Explore | Cognitive
Did the AI attack wave arrive – or something else? → Explore | AI
Your biggest insider risk – malicious or well-meaning? → Explore | Threat Detection
What do takedowns really do to ransomware gangs? → Explore | Law Enforcement
The CVE flood: did it reach real networks? → Explore | Vulnerabilities
Be among the first readers of the Navigator 2027!
