Iceland
ISRansomware victim intelligence profile · Ranked #102 globally · Updated: Sep 17, 2026
ThreatAI Analysis
Compiled from this database and the ransomware.live profiles of the groups active in Iceland. Figures are computed from the tracked records, not inferred.
Iceland sees six ransomware attacks reported annually, ranking 102 globally, with groups like Thegentlemen and Warlock most active, hitting sectors including Business Services and Technology.
Iceland in the global picture
Iceland accounts for 6 of the ransomware disclosures tracked here, ranking #102 worldwide and making up 0% of the global total. The sectors listed most often are Business Services, Technology, Agriculture and Food Production.
Who is most active in Iceland
Thegentlemen — 2 victims in Iceland. Warlock — 1 victims in Iceland. The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. Lockbit3 — 1 victims in Iceland.
Ransomware Threat Profile: Iceland
Iceland ranks #102 globally for ransomware attacks, with 6 confirmed victims in this database — representing 0% of the worldwide total. The most active ransomware groups targeting Iceland include Thegentlemen, Warlock, Lockbit3.
The most frequently targeted industries in Iceland are Business Services, Technology, Agriculture and Food Production. Manufacturing organisations are attractive targets because production downtime directly impacts revenue, creating strong incentives to restore operations by paying the ransom.
Iceland's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Iceland should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Iceland (showing 6 of 6)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | Known | Thegentlemen | Technology | Jul 31, 2026 |
| 2 | Farmers Association of Iceland | Thegentlemen | Agriculture and Food Production | May 6, 2026 |
| 3 | miltech.local | Warlock | — | Nov 6, 2025 |
| 4 | vikurverk.is | Lockbit3 | Business Services | Nov 1, 2024 |
| 5 | Karvo Companies, Inc. | Bianlian | Business Services | Jul 26, 2024 |
| 6 | https://www.gadotbio.com/ Gadot Biochemical Industries Ltd | Alphalocker | Manufacturing | Jan 24, 2024 |
Frequently Asked Questions
How many ransomware attacks have occurred in Iceland?
Iceland has recorded 6 ransomware victim disclosures in this database, ranking #102 globally. This represents 0% of all tracked ransomware attacks worldwide.
Which ransomware groups target Iceland?
The ransomware groups most active in Iceland are Thegentlemen, Warlock, Lockbit3, Bianlian. These groups collectively account for the majority of victim disclosures attributed to Iceland.
Which industries are most targeted by ransomware in Iceland?
In Iceland, the most frequently targeted sectors are Business Services, Technology, Agriculture and Food Production. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Iceland rank globally for ransomware attacks?
Iceland ranks #102 globally for ransomware attacks with 6 victim disclosures, representing 0% of the worldwide total of 21,694 tracked victims.
How can organisations in Iceland protect against ransomware?
Organisations in Iceland should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Iceland is also recommended.