Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
PT

Ransomware attacks in Portugal

75 organisations in Portugal have been listed on ransomware leak sites, ranking #38 worldwide. Updated .

Victims
75
0.3% of global total
Global rank
#38
of 180 countries
Active groups
32
Most: Qilin
Sectors
16
Most: Manufacturing

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Portugal. Figures are computed from the tracked records, not inferred.

Portugal sees 74 recorded ransomware attacks globally ranked 38th, predominantly targeted by groups Qilin, Thegentlemen, Akira with sectors Manufacturing, Technology, Hospitality and Tourism hit hardest.

Portugal in the global picture

Portugal accounts for 75 of the ransomware disclosures tracked here, ranking #38 worldwide and making up 0.3% of the global total. The sectors listed most often are Manufacturing, Technology, Hospitality and Tourism.

Who is most active in Portugal

Qilin — 12 victims in Portugal. Qilin ransomware was first observed in July of 2022. Thegentlemen — 11 victims in Portugal. Akira — 6 victims in Portugal. The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group.

Where to report an incident in Portugal

National computer emergency response teams for Portugal, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: Portugal

Portugal ranks #38 worldwide for ransomware disclosures, with 75 victims in this database — 0.3% of the global total. The groups listing the most organisations here are Qilin, Thegentlemen and Akira.

The most frequently listed industries in Portugal are Manufacturing, Technology, Hospitality and Tourism. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Portugal's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Portugal 75

Organization Disclosed
Company #103
N0n
CREDIN
Qilin
Brancoptica
Thegentlemen
Ligue se Grupo
Thegentlemen
Tomix / Grupo JOPER
Spacebears
hbpro.pt
Safepay
hbpro.pt
Safepay
Chip7
Thegentlemen
Directorate-General for Education
Panzer
www.ptesm.com
Blackwater
icnavais.com
Lockbit5
GRUPO STARFOODS
Majinahanashi
*****.com.pt
Section9
createinfor.pt
M3rx
GUERREIROS seguros
Thegentlemen
Sirl
Thegentlemen
Tèrra Aventura
Nova
Tèrra Aventura
Nova
Metro Mondego
Thegentlemen
gemese.pt
Arcusmedia
Centro Científico e Cultural de Macau
Qilin
Aveiro Constructors Limited
Thegentlemen
Anidaport - Investimentos Imobiliários Lda., Lisbon, Portugal
Deadlock
Sisint
Qilin
conduril.pt
Settra
lpgroup.pt
Nova
Misericórdia de Santo Tirso
Qilin
M Rocha J Serra Lda
Thegentlemen
Soja de Portugal
Thegentlemen
MEISA - Sines
Qilin
maiadouro.pt
Safepay
vitropor.pt
Lockbit5
Arnaud
Qilin
Sacor
Qilin
MicroChem
Thegentlemen
thenavigatorcompany.com
Safepay
Museu do Caramulo
Thegentlemen
ambisig.com
Lockbit5
manuaco.pt
Lockbit5
SPZC
Nova
Espaço Casa
Qilin
Armis Group
Ransomhouse
Enerre Pharma Lda
Dragonforce
Cimertex
Qilin
Miguel Veiga, Neiva Santos e Associados.
Direwolf
espectral.pt
Obscura
www.profimetrics.com
Devman
António Belém & António Gonçalve
Ciphbit
Espectral
Obscura
Dualinfor hito inovation
Dragonforce
L-Pimenta (etdeletronics)
Qilin
pt.elis.com
Devman
QUINTADAMARINHA.com
Qilin
Ersar
Warlock
Calcadawines
Nightspire
Selenis (Evertis)
Akira
Selenis (Evertis is also involved)
Akira
valedolobo.com
Braincipher
NewHotel cloud
Nova
M'AR De AR Hotels
Nitrogen
Global Media Group
Nitrogen
Agricola Da Quinta De Corona
Akira
Socarpor
Akira
Pervedant
Lynx
omniflow.com
Akira
Kitevuc - Equipamentos E Veiculos Utilitários E Comerciais
Ciphbit
Grupo Bébécar
8base
chaves
Qilin
António Belém & António Gonçalves
Ciphbit
Perfumes & Companhia
Akira
aloft
Incransom
grupocadarso.com
Blackbasta
Mesopolys
Spacebears
Bwizer
Trigona
portline.pt
Lockbit3

Frequently asked questions

How many ransomware attacks have occurred in Portugal?

Portugal has recorded 75 ransomware victim disclosures in this database, ranking #38 globally. This represents 0.3% of all tracked ransomware attacks worldwide.

Which ransomware groups target Portugal?

The ransomware groups most active in Portugal are Qilin, Thegentlemen, Akira, Nova. These groups collectively account for the majority of victim disclosures attributed to Portugal.

Which industries are most targeted by ransomware in Portugal?

In Portugal, the most frequently targeted sectors are Manufacturing, Technology, Hospitality and Tourism. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Portugal rank globally for ransomware attacks?

Portugal ranks #38 globally for ransomware attacks with 75 victim disclosures, representing 0.3% of the worldwide total of 23,581 tracked victims.

How can organisations in Portugal protect against ransomware?

Organisations in Portugal should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Portugal is also recommended.