Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
GB #4 most targeted country

Ransomware attacks in United Kingdom

969 organisations in United Kingdom have been listed on ransomware leak sites, ranking #4 worldwide. Updated .

Victims
969
4.1% of global total
Global rank
#4
of 181 countries
Active groups
129
Most: Qilin
Sectors
21
Most: Business Services

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in United Kingdom. Figures are computed from the tracked records, not inferred.

The United Kingdom faces 965 recorded ransomware attacks placing it at a global rank of 4, striking particularly hard sectors like Business Services and Manufacturing, alongside threat actors Qilin, Thegentlemen, and Dragonforce.

United Kingdom in the global picture

United Kingdom accounts for 969 of the ransomware disclosures tracked here, ranking #4 worldwide and making up 4.1% of the global total. The sectors listed most often are Business Services, Manufacturing, Technology.

Who is most active in United Kingdom

Qilin — 119 victims in United Kingdom. Qilin ransomware was first observed in July of 2022. Thegentlemen — 48 victims in United Kingdom. Dragonforce — 47 victims in United Kingdom.

Where to report an incident in United Kingdom

National computer emergency response teams for United Kingdom, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: United Kingdom

United Kingdom ranks #4 worldwide for ransomware disclosures, with 969 victims in this database — 4.1% of the global total. The groups listing the most organisations here are Qilin, Thegentlemen and Dragonforce.

The most frequently listed industries in United Kingdom are Business Services, Manufacturing, Technology. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

As a major economy with many large enterprises, United Kingdom is a consistent target for groups seeking large payments. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in United Kingdom 969

Page 1 of 10
Organization Disclosed
ADL Lift Services Limited
Auditteam
PWC
Everest
Allmand-Smith Limited
Aurora
novagroupgbc.com
Braincipher
Aveva
Mimori
Johnson & Pace
Qilin
Robert Hitchins Limited
Majinahanashi
JJS Justice
Thegentlemen
Martin LLP
Thegentlemen
camden-living
Iah6477
Kemlows Diecasting Products Limited
Qilin
Videk
Akira
AD***ed
Auditteam
Excess Baggage
Ransomhouse
Sa***ge
Auditteam
Saddlers Court MFG
Play
BMT IQ (marine surveying and inspection)
N0n
Cognosis Limited
Nightspire
KP Industries
Nightspire
The Margo Hotel
Majinahanashi
AnyTech365
Thegentlemen
Greenbrook Engineering
Thegentlemen
lopay
Black x
seven seas group
Spirals
Westrop Primary & Nursery School
Thegentlemen
hollypoultry.com
Settra
hollypoultry.com
Settra
Sports Events365
Qilin
Sports Events365
Qilin
Dynamic Office Solutions
Qilin
parkdental.com
Chaos
parkdental.com
Chaos
Defencebit
Thegentlemen
Defencebit
Thegentlemen
Williamson Dacar Associates
Thegentlemen
Williamson Dacar Associates
Thegentlemen
maxwell-group.com
Braincipher
maxwell-group.com
Braincipher
Precision Facades Ltd
N0n
Precision Facades Ltd
N0n
Dediserve Ltd
N0n
Dediserve Ltd
N0n
safescaffolding.net
Threeam
Crystal Glass
Thegentlemen
Crystal Glass
Thegentlemen
Ar Valve Resources
Wallstreet
Ar Valve Resources
Wallstreet
Beatus Cartons
Wallstreet
Beatus Cartons
Wallstreet
GDM Pipelines
Qilin
GDM Pipelines
Qilin
Revolut
Imnotavillain
ukbjja.org
Incransom
ukbjja.org
Incransom
AMEY-CO.UK
Clop
INFINIGATE.CH(INFINIGATE.CO.UK)
Clop
SAUL-ORG.UK
Clop
hoyletanner.com
Braincipher
Manders
Akira
Manders
Akira
Owen Leigh Optometry
Dragonforce
Owen Leigh Optometry
Dragonforce
High Oakham Primary School
Thegentlemen
Gilco Scaffolding
Qilin
Gilco Scaffolding
Qilin
Strad Solutions
Vexy ransomware
Strad Solutions
Vexy ransomware
RelyComply AML Platform
Direwolf
RelyComply AML Platform
Direwolf
Brent Electric
Akira
Brent Electric
Akira
copeplastics.com
Chaos
copeplastics.com
Chaos
Ben Leeds Properties
Shadowbyt3$
Ben Leeds Properties
Shadowbyt3$
Ben Leeds Properties WARNING
Shadowbyt3$
The Big Table
Qilin
The Big Table
Qilin
Marlborough Partners
Anubis
Manchester Airports Group
Fulcrumsec
The Sole
Thegentlemen
manhattanloft.co.uk
Settra
www.lichtvision.com
Incransom
Absolute Consultancy Services
Qilin
Brebur
Thegentlemen
MB Associates
Thegentlemen
macallister.com
Chaos
Whitehouse
Qilin
DAB Investments
Qilin
Displaydata
Qilin
LGG Advisors
Qilin
Air International Thermal Systems
Qilin
Metal Conversions
Qilin
Morgan Services
Ailock
Party Rental
Thegentlemen
A-Plus Software Limited
Shadowbyt3$
Knottingham Trent University
Shadowbyt3$
Davroc
Booba project
JP Molyneux Studio
Deadlock
The Margo Hotel
Majinahanashi
1–100 of 969

Frequently asked questions

How many ransomware attacks have occurred in United Kingdom?

United Kingdom has recorded 969 ransomware victim disclosures in this database, ranking #4 globally. This represents 4.1% of all tracked ransomware attacks worldwide.

Which ransomware groups target United Kingdom?

The ransomware groups most active in United Kingdom are Qilin, Thegentlemen, Dragonforce, Akira. These groups collectively account for the majority of victim disclosures attributed to United Kingdom.

Which industries are most targeted by ransomware in United Kingdom?

In United Kingdom, the most frequently targeted sectors are Business Services, Manufacturing, Technology. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does United Kingdom rank globally for ransomware attacks?

United Kingdom ranks #4 globally for ransomware attacks with 969 victim disclosures, representing 4.1% of the worldwide total of 23,641 tracked victims.

How can organisations in United Kingdom protect against ransomware?

Organisations in United Kingdom should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting United Kingdom is also recommended.