H1 2026 State of Breach Disclosure: A Record Half the US Didn't Drive

Two records, one crime wave

Every ransomware breach can enter the public record twice. The criminals keep the first record: “leak sites,” where gangs post the names of victims — typically those who refused to pay — as leverage and as advertising. Regulators keep the second: breach notifications filed with state attorneys general, federal health authorities, and the SEC. DisclosureLens ingests both, continuously, from 22 sources. This report counts what each record showed in the first half of 2026.

One definition before the numbers. A leak-site posting is a criminal allegation: it means a gang claimed an organization as a victim, not that a breach has been independently confirmed. Claims are hashed at ingest, and duplicate copies of a post that the aggregator later re-dated have been removed from the counts here (until our corrections of September 25, September 30 and October 3, 2026, such a post counted once per date — see the corrections below). Our daily completeness sweep backfills anything the real-time feed missed, symmetrically for this year and last, so the comparison below is apples to apples.

The record half

Gangs posted 4,582 victims in H1 2026, against 4,098 in H1 2025 (+12%) and 3,842 in H2 2025. Independent trackers agree on the direction: Comparitech logged 4,217 attacks in the same window and likewise called it a new high; DBDigest counted 4,725 victims. Our count sits between the two.

What makes the half remarkable is its shape. The record quarter — Q1 2025, 2,452 postings — was a spike: a single mass-publication event pushed February 2025 to 1,054 postings, a monthly figure nothing since has approached. H1 2026 had no such month: it produced 2,290 postings in Q1 and 2,292 in Q2 — the nearer of the two about 160 postings short of that quarterly record, but together the largest half on record. Spike-driven records tell you one gang had a good month. Breadth-driven records tell you the system got bigger.

The geography surprise: America's share is falling

Split the record half by victim geography and the headline inverts. Postings naming US organizations: roughly 1,902 in H1 2025, 1,784 in H1 2026 — down about 6%. Postings for victims everywhere else (including the small untagged share): up from about 2,196 to about 2,798, a 27% jump. The US share of geo-identified victims, which had held roughly between 49% and 51% for two years, fell to 42% — the lowest we have measured. At the organization level the picture is the same: distinct US victims declined about 6%.

We tried to break this finding before believing it. The geographic tags are machine-extracted, so we checked every way we know for the measurement to lie. Tag formats: our filter accepts every US tag variant in the corpus — an exhaustive scan found zero variants it misses, in any half. Extractor drift: if our tagger had simply become stingier about “US,” every gang's US share would fall together. The opposite happened — Akira's US share rose from 54% to 72% and INC Ransom's from 60% to 65%, while the half's two volume leaders simply operate elsewhere: Qilin's postings were 38% US and TheGentlemen's 19% (the relaunched LockBit's, 10%; those four 2026 shares are as first measured — see the note under the gang table). And the untagged remainder, which grew from about 180 postings to 331, cannot rescue the US number under any plausible assumption: impute it at each half's own US rate and US volume still falls, by about 3%. With H1 2025's untagged postings imputed at that half's own US rate, US volume would have grown only if roughly three in five or more untagged 2026 postings were American — far more than the 42% of the tagged postings they sit beside.

The drop, in other words, is composition: the gangs that grew are the gangs that don't primarily claim American victims. External trackers see the same direction — ReliaQuest put the US share of global victims at 49.3% in Q2 2026, down from 51.9%; Check Point noted LockBit's US share had fallen to 21.2% with “Italy, Brazil, and Turkey picking up the slack”; European victim growth ran far ahead of the US. No tracker we found has led with the finding that US volume did not grow; windows and geo-attribution methods differ tracker to tracker, but the falling US share is the common thread.

Why it's happening is harder than whether. International expansion of affiliate recruiting, US law-enforcement pressure displacing targeting, new brands born outside the traditional US-focused playbook — or American victims paying more often (a posting typically records a victim who refused; payment suppresses publication without any change in targeting) — all are consistent with the data, which measures where posted victims are, not why. We flag the question rather than answer it. One honest caution: geography tagging has thinned in the most recent months — about 96% of postings carried a tag through 2025, 91% in May 2026 and 85% in June — so this section reports halves and quarters, never single recent months.

The gang economy churned at startup speed

The supply side of the criminal record was rebuilt in eighteen months, and H1 2026 is what the rebuilt version produces at full speed.

The new #1 doubled. Qilin posted 658 victims in the half, twice its H1 2025 pace — a run ZeroFox likewise scores as an unbroken twelve months at the top of the global table. Qilin was the primary beneficiary of the ecosystem's biggest vacancy: RansomHub, the most prolific operation of 2024, went dark on April 1, 2025, and its affiliates publicly scattered to Qilin and DragonForce. Both appear in this table's growth column; RansomHub does not appear at all.

The fastest riser barely existed a year ago. TheGentlemen posted 35 victims in H1 2025 and 457 in H1 2026 — growth Halcyon calls the fastest scaling of any group on record. (Some trackers score TheGentlemen ahead of Qilin for Q2 specifically; we have Qilin 292 to 281. On the half, it isn't close.) Cl0p, the gang whose Cleo-campaign spike set the old quarterly record, posted 129 — down 68% from its spike-year pace, the comedown that mass-exploitation campaigns reliably produce between exploits.

A third of the market is new this half. 35 brands published their first victim in H1 2026 (DBDigest independently counts 42 new operators). Two of them — Krybit (58 postings) and Payload (63) — reached top-25 volume within months of appearing. The active-brand count hit 110, a record, up from 91 two years earlier. Barriers to entry in the extortion economy are effectively zero, and brand loyalty is nonexistent — which is exactly what the disruptions of the last three years (the LockBit takedown, ALPHV's collapse under enforcement pressure, RansomHub going dark) select for: fewer giants, more startups.

We checked both ways this could be an illusion. The debuts are real brands, not renamed old ones: the only first-timer with a plausible prior-brand match in our corpus was Payload, and independent malware analysis dates its emergence to February 17, 2026 — the same day as its first posting here — as a new operation built on leaked Babuk source code, unrelated to the dormant 2021 brand of a similar name. And the record half is not gangs re-posting each other's old victims, the recycling behavior documented around brand collapses: only 2.4% of H1 2026 postings (as first measured) name a victim previously claimed by a different gang.

The US regulatory mirror

While the criminal record set records abroad, the American regulatory record ticked along. Measuring filing growth honestly requires an admission most trackers never make: coverage drift. Our raw state-AG total moved from 3,454 filings in H1 2025 to 3,477 in H1 2026 — near-flat at the snapshot — but that number is uninterpretable, because we gained two states (Texas and Massachusetts onboarding added roughly 640 filings by July 31) and lost volume in four others to our own collection outages and portal changes (Montana 274→18, Maryland 243→63, Oregon 157→83, Idaho 73→8). None of that is victim behavior. Those are July-31 figures, and continued backfilling has since moved several of them — including the raw total itself, which no longer reads flat; see the August 18 update below. The honest subset is the four states our collectors covered continuously and healthily in both halves:

Four-point-four percent. Against a 12% rise in global criminal publication — and, more tellingly, against falling US criminal publication — the US compliance channel looks stable to slowly growing. At the federal securities level, the numbers are smaller still: 13 SEC Item 1.05 cyber 8-Ks in six months (24 counting filings that disclosed cyber incidents under the catch-all Item 8.01) — against thousands of state filings. The SEC's materiality hurdle keeps the national-exchange disclosure channel a boutique record.

Where the two records meet

The natural question — how often does a leak-site victim later appear in the regulatory record? — is the subject of its own study, The Silent Majority. The short version, from our 2024 US cohort: only about 1 in 5 identifiable US organizations posted on leak sites can be matched to any regulatory filing — and where a claim and a filing are linked to the same incident, the criminal post came first in more than four of five cases, with the filing following a median of close to three months later, measured from when the post was first seen on the leak site. Those numbers describe the 2024 cohort, not this half; the full method, matching audit, and limitations ship with that piece.

Method & limitations

Corpus. DisclosureLens continuously ingests 22 disclosure sources: 17 US state attorney-general breach registries, HHS OCR, SEC EDGAR, EU DPA enforcement decisions, press coverage, and ransomware leak-site claims. Snapshot date for every number in this report: July 31, 2026.

Counting. A “posting” is one deduplicated leak-site claim naming one victim organization. Claims are hashed at ingest on their group, victim and attack date, so a re-capture of an unchanged post creates no new record — but a post the aggregator later re-dated used to read as a new claim, and the snapshot counted it once per date. Those duplicate copies were removed on September 25, 2026, and every count in this report is corrected for them (see the corrections below). Of the 136 duplicated posts that correction held for review, 111 were resolved on September 28–30, 2026 (110 of them by removing their extra copies) and the last 25 on October 2, 2026, by removing theirs; every count here is corrected for those too, so every duplicated post we identified now counts once. A daily completeness sweep re-fetches the full current and previous year from the upstream aggregator, so both halves of the year-over-year comparison are backfilled by the same mechanism (as first measured, before the duplicates were removed, H1 2025's total included 904 sweep-recovered postings and H1 2026's 1,403). Late captures continue to trickle in — H1 2026 gained 133 postings during July, once duplicate copies are set aside — so counts are floors with respect to late captures. They were not floors in the respect the correction fixes: removing the duplicates narrowed the year-over-year margin from +17% to +12%.

Allegations, not adjudications. Leak-site postings are criminal claims. Gangs exaggerate and occasionally fabricate; postings are not independently confirmed breaches, and we name no victims from claims in this report.

Geography. Victim-geography tags are LLM-extracted from claim content. 92.8% of H1 2026 postings carry one, against 95.7% a year earlier; the shortfall is not a processing backlog (those postings are fully extracted and simply carry no geography), and the rate is lowest in the newest months — 85% in June — which is why no single-month figure appears here. That leaves 331 untagged H1 2026 postings against about 180 in H1 2025, and how they are treated is the one assumption this finding rests on. Measured on tagged postings, US volume fell 6.2% (1,902 → 1,784). Imputing the untagged remainder at each half's own US rate gives about −3% — down either way. The arithmetic worst case, in which nearly every untagged 2026 posting is American and almost none of 2025's were, would put US growth near +11%; we consider that implausible, because it requires untagged postings to be roughly twice as American as the tagged ones alongside them, but we state it rather than bury it. The finding was additionally stress-tested by tag-format audit and per-gang decomposition, and holds under both. We therefore report US volume as down by about 3% to 6%, depending on how the untagged remainder is treated, rather than as a single point estimate. One selection effect no postings dataset escapes: a victim who quietly pays typically never appears on a leak site, so posting geography blends targeting with payment behavior — a shift in US payment rates could move the US count without any change in who gets attacked. It is listed among the candidate explanations above for exactly that reason.

Gang attribution uses each posting's canonical actor label; brand counts treat labels as brands, and splinter groups sharing infrastructure count separately. Fixed-coverage subset: states qualify by healthy, continuous collection in both compared halves, verified month by month; excluded states' drift is disclosed above rather than blended in. What we deliberately do not claim: a record quarter (Q1 2025, at 2,452 postings, remains the record; with duplicate copies removed, Q2 2026 trails it by about 160 postings rather than the three the snapshot showed); any affected-individual counts; any per-victim assertion from a claim alone.

Every figure in this report is reproducible from our database; the SQL behind each number is available on request.

What to watch

If the geography shift holds through H2, the implication is uncomfortable for a US-centric security industry: the ransomware economy is growing around American defenses, American law-enforcement pressure, and American disclosure law — not through them. Threat models, cyber-insurance books, and regulatory debates calibrated on “the US is half the problem” will need recalibrating. DisclosureLens tracks both records — criminal and regulatory — continuously, and flags when a leak-site claim gains (or conspicuously never gains) a regulatory echo. The dataset behind this report is queryable via our API.