Sri Lanka
LKRansomware victim intelligence profile · Ranked #73 globally · Updated: Sep 6, 2026
ThreatAI Analysis
Compiled from this database and the ransomware.live profiles of the groups active in Sri Lanka. Figures are computed from the tracked records, not inferred.
Sri Lanka has seen ransomware activity with 16 recorded victims globally ranking 71st, primarily targeting tech companies as well as agriculture and business services by groups like Payload and Cloak.
Sri Lanka in the global picture
Sri Lanka accounts for 16 of the ransomware disclosures tracked here, ranking #73 worldwide and making up 0.1% of the global total. The sectors listed most often are Technology, Agriculture and Food Production, Business Services.
Who is most active in Sri Lanka
Payload — 2 victims in Sri Lanka. Cloak — 2 victims in Sri Lanka. Blacknevas — 1 victims in Sri Lanka.
Ransomware Threat Profile: Sri Lanka
Sri Lanka ranks #73 globally for ransomware attacks, with 16 confirmed victims in this database — representing 0.1% of the worldwide total. The most active ransomware groups targeting Sri Lanka include Payload, Cloak, Blacknevas.
The most frequently targeted industries in Sri Lanka are Technology, Agriculture and Food Production, Business Services. Manufacturing organisations are attractive targets because production downtime directly impacts revenue, creating strong incentives to restore operations by paying the ransom.
Sri Lanka's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Sri Lanka should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Sri Lanka (showing 16 of 16)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | Abans Group | Blacknevas | Consumer Services | Jul 1, 2026 |
| 2 | Synex International Pvt Ltd | Dragonforce | Technology | Jun 1, 2026 |
| 3 | SIRILAK SEAFOOD (PW) LTD. | Titan | Agriculture and Food Production | May 30, 2026 |
| 4 | Ceywater Consultants | Worldleaks | Business Services | May 1, 2026 |
| 5 | Marino Food Products Pvt | Payload | Agriculture and Food Production | Apr 16, 2026 |
| 6 | NKAR Travels & Tours | Payload | Hospitality and Tourism | Mar 30, 2026 |
| 7 | MASHOLDINGS.COM | Clop | Manufacturing | Nov 21, 2025 |
| 8 | Provincial Department of Health Services Sri Lanka | Kryptos | Public Sector | Nov 6, 2025 |
| 9 | www.midcity.lk | Yurei | Agriculture and Food Production | Sep 5, 2025 |
| 10 | Pensions.gov.lk | Cloak | Public Sector | Jun 27, 2025 |
| 11 | VS One Technology | Nova | Technology | May 27, 2025 |
| 12 | Pe*************.lk | Cloak | — | Apr 18, 2025 |
| 13 | Cargills Bank | Hunters | Financial Services | Mar 20, 2025 |
| 14 | Richardson | Qilin | Business Services | Jan 19, 2025 |
| 15 | PeoplesHR | Meow | Technology | Aug 2, 2024 |
| 16 | lankacom.net | Darkvault | Business Services | Apr 11, 2024 |
Frequently Asked Questions
How many ransomware attacks have occurred in Sri Lanka?
Sri Lanka has recorded 16 ransomware victim disclosures in this database, ranking #73 globally. This represents 0.1% of all tracked ransomware attacks worldwide.
Which ransomware groups target Sri Lanka?
The ransomware groups most active in Sri Lanka are Payload, Cloak, Blacknevas, Dragonforce. These groups collectively account for the majority of victim disclosures attributed to Sri Lanka.
Which industries are most targeted by ransomware in Sri Lanka?
In Sri Lanka, the most frequently targeted sectors are Technology, Agriculture and Food Production, Business Services. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Sri Lanka rank globally for ransomware attacks?
Sri Lanka ranks #73 globally for ransomware attacks with 16 victim disclosures, representing 0.1% of the worldwide total of 21,391 tracked victims.
How can organisations in Sri Lanka protect against ransomware?
Organisations in Sri Lanka should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Sri Lanka is also recommended.