Portugal
PTRansomware victim intelligence profile · Ranked #38 globally · Updated: Sep 5, 2026
ThreatAI Analysis
Compiled from this database and the ransomware.live profiles of the groups active in Portugal. Figures are computed from the tracked records, not inferred.
Portugal reports 66 ransomware incidents globally ranked 37th in ransomware activity with key actors like Qilin and Thegentlemen targeting Manufacturing, Technology, and Hospitality sectors.
Portugal in the global picture
Portugal accounts for 67 of the ransomware disclosures tracked here, ranking #38 worldwide and making up 0.3% of the global total. The sectors listed most often are Manufacturing, Technology, Hospitality and Tourism.
Who is most active in Portugal
Qilin — 11 victims in Portugal. Qilin ransomware was first observed in July of 2022. Thegentlemen — 8 victims in Portugal. Akira — 6 victims in Portugal. The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.
Where to report an incident in Portugal
- Servico de Coordenacao Nacional da Resposta a Incidentes de Ciberseguranca · [email protected] · website
National computer emergency response teams for Portugal, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.
Ransomware Threat Profile: Portugal
Portugal ranks #38 globally for ransomware attacks, with 67 confirmed victims in this database — representing 0.3% of the worldwide total. The most active ransomware groups targeting Portugal include Qilin, Thegentlemen, Akira.
The most frequently targeted industries in Portugal are Manufacturing, Technology, Hospitality and Tourism. The healthcare sector is particularly vulnerable because attacks on hospitals and medical providers can create life-threatening situations, increasing pressure to pay ransoms quickly.
Portugal's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Portugal should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Portugal (showing 67 of 67)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | Directorate-General for Education | Panzer | Government & Defense | Aug 28, 2026 |
| 2 | www.ptesm.com | Blackwater | — | Aug 24, 2026 |
| 3 | icnavais.com | Lockbit5 | — | Aug 22, 2026 |
| 4 | GRUPO STARFOODS | Majinahanashi | Agriculture and Food Production | Aug 12, 2026 |
| 5 | *****.com.pt | Section9 | Education | Jul 26, 2026 |
| 6 | createinfor.pt | M3rx | Professional Services | Jul 26, 2026 |
| 7 | GUERREIROS seguros | Thegentlemen | Financial Services | Jul 23, 2026 |
| 8 | Sirl | Thegentlemen | — | Jul 23, 2026 |
| 9 | Tèrra Aventura | Nova | Hospitality and Tourism | Jul 21, 2026 |
| 10 | Tèrra Aventura | Nova | Hospitality and Tourism | Jul 21, 2026 |
| 11 | Metro Mondego | Thegentlemen | Transportation/Logistics | Jul 16, 2026 |
| 12 | gemese.pt | Arcusmedia | Professional Services | Jul 14, 2026 |
| 13 | Centro CientÃfico e Cultural de Macau | Qilin | Education | Jul 13, 2026 |
| 14 | Aveiro Constructors Limited | Thegentlemen | Construction | Jul 11, 2026 |
| 15 | Anidaport - Investimentos Imobiliários Lda., Lisbon, Portugal | Deadlock | Financial Services | Jul 10, 2026 |
| 16 | Sisint | Qilin | Technology | Jul 3, 2026 |
| 17 | conduril.pt | Settra | Manufacturing | Jun 28, 2026 |
| 18 | lpgroup.pt | Nova | Business Services | Jun 24, 2026 |
| 19 | Misericórdia de Santo Tirso | Qilin | Healthcare | Jun 16, 2026 |
| 20 | M Rocha J Serra Lda | Thegentlemen | Business Services | Jun 4, 2026 |
| 21 | Soja de Portugal | Thegentlemen | Agriculture and Food Production | Jun 4, 2026 |
| 22 | MEISA - Sines | Qilin | Energy | Jun 3, 2026 |
| 23 | maiadouro.pt | Safepay | Agriculture and Food Production | May 4, 2026 |
| 24 | vitropor.pt | Lockbit5 | Manufacturing | Apr 14, 2026 |
| 25 | Arnaud | Qilin | — | Mar 26, 2026 |
| 26 | Sacor | Qilin | — | Mar 26, 2026 |
| 27 | MicroChem | Thegentlemen | Technology | Mar 19, 2026 |
| 28 | thenavigatorcompany.com | Safepay | Manufacturing | Mar 17, 2026 |
| 29 | Museu do Caramulo | Thegentlemen | Hospitality and Tourism | Feb 10, 2026 |
| 30 | ambisig.com | Lockbit5 | Technology | Dec 26, 2025 |
| 31 | manuaco.pt | Lockbit5 | Manufacturing | Dec 26, 2025 |
| 32 | SPZC | Nova | Education | Dec 19, 2025 |
| 33 | Espaço Casa | Qilin | Consumer Services | Dec 4, 2025 |
| 34 | Armis Group | Ransomhouse | Business Services | Dec 3, 2025 |
| 35 | Enerre Pharma Lda | Dragonforce | Healthcare | Nov 27, 2025 |
| 36 | Cimertex | Qilin | Manufacturing | Nov 20, 2025 |
| 37 | Miguel Veiga, Neiva Santos e Associados. | Direwolf | — | Oct 14, 2025 |
| 38 | espectral.pt | Obscura | Technology | Oct 13, 2025 |
| 39 | www.profimetrics.com | Devman | Technology | Oct 1, 2025 |
| 40 | António Belém & António Gonçalve | Ciphbit | — | Sep 24, 2025 |
| 41 | Espectral | Obscura | Technology | Sep 19, 2025 |
| 42 | Dualinfor hito inovation | Dragonforce | Business Services | Aug 21, 2025 |
| 43 | L-Pimenta (etdeletronics) | Qilin | Technology | Aug 14, 2025 |
| 44 | pt.elis.com | Devman | Business Services | Jul 20, 2025 |
| 45 | QUINTADAMARINHA.com | Qilin | Hospitality and Tourism | Jul 2, 2025 |
| 46 | Ersar | Warlock | — | Jun 11, 2025 |
| 47 | Calcadawines | Nightspire | Agriculture and Food Production | May 24, 2025 |
| 48 | Selenis (Evertis) | Akira | Manufacturing | May 8, 2025 |
| 49 | Selenis (Evertis is also involved) | Akira | Manufacturing | May 8, 2025 |
| 50 | valedolobo.com | Braincipher | Hospitality and Tourism | May 5, 2025 |
| 51 | NewHotel cloud | Nova | Hospitality and Tourism | Apr 28, 2025 |
| 52 | M'AR De AR Hotels | Nitrogen | Hospitality and Tourism | Apr 25, 2025 |
| 53 | Global Media Group | Nitrogen | Technology | Apr 18, 2025 |
| 54 | Agricola Da Quinta De Corona | Akira | Agriculture and Food Production | Apr 14, 2025 |
| 55 | Socarpor | Akira | Transportation/Logistics | Apr 2, 2025 |
| 56 | Pervedant | Lynx | Manufacturing | Mar 5, 2025 |
| 57 | omniflow.com | Akira | Technology | Jan 31, 2025 |
| 58 | Kitevuc - Equipamentos E Veiculos Utilitários E Comerciais | Ciphbit | Manufacturing | Jan 1, 2025 |
| 59 | Grupo Bébécar | 8base | Manufacturing | Dec 21, 2024 |
| 60 | chaves | Qilin | Public Sector | Dec 17, 2024 |
| 61 | António Belém & António Gonçalves | Ciphbit | Financial Services | Dec 13, 2024 |
| 62 | Perfumes & Companhia | Akira | Business Services | Jun 19, 2024 |
| 63 | aloft | Incransom | Hospitality and Tourism | Jun 7, 2024 |
| 64 | grupocadarso.com | Blackbasta | Business Services | May 21, 2024 |
| 65 | Mesopolys | Spacebears | Business Services | May 18, 2024 |
| 66 | Bwizer | Trigona | Healthcare | Mar 16, 2024 |
| 67 | portline.pt | Lockbit3 | Transportation/Logistics | Feb 5, 2024 |
Frequently Asked Questions
How many ransomware attacks have occurred in Portugal?
Portugal has recorded 67 ransomware victim disclosures in this database, ranking #38 globally. This represents 0.3% of all tracked ransomware attacks worldwide.
Which ransomware groups target Portugal?
The ransomware groups most active in Portugal are Qilin, Thegentlemen, Akira, Nova. These groups collectively account for the majority of victim disclosures attributed to Portugal.
Which industries are most targeted by ransomware in Portugal?
In Portugal, the most frequently targeted sectors are Manufacturing, Technology, Hospitality and Tourism. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Portugal rank globally for ransomware attacks?
Portugal ranks #38 globally for ransomware attacks with 67 victim disclosures, representing 0.3% of the worldwide total of 21,374 tracked victims.
How can organisations in Portugal protect against ransomware?
Organisations in Portugal should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Portugal is also recommended.