Skip to content
CTI Academy Sponsor CTI Academy
SE

Ransomware attacks in Sweden

160 organisations in Sweden have been listed on ransomware leak sites, ranking #20 worldwide. Updated .

Victims
160
0.7% of global total
Global rank
#20
of 181 countries
Active groups
52
Most: Qilin
Sectors
19
Most: Manufacturing

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Sweden. Figures are computed from the tracked records, not inferred.

Ransomware attacks against Sweden have recorded 160 victims globally among the top 20 nations in terms of activity, with groups like Qilin and Thegentlemen frequently targeting Manufacturing and Business Services sectors.

Sweden in the global picture

Sweden accounts for 160 of the ransomware disclosures tracked here, ranking #20 worldwide and making up 0.7% of the global total. The sectors listed most often are Manufacturing, Business Services, Technology.

Who is most active in Sweden

Qilin — 15 victims in Sweden. Qilin ransomware was first observed in July of 2022. Thegentlemen — 13 victims in Sweden. Wallstreet — 10 victims in Sweden.

Where to report an incident in Sweden

National computer emergency response teams for Sweden, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: Sweden

Sweden ranks #20 worldwide for ransomware disclosures, with 160 victims in this database — 0.7% of the global total. The groups listing the most organisations here are Qilin, Thegentlemen and Wallstreet.

The most frequently listed industries in Sweden are Manufacturing, Business Services, Technology. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Sweden's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Sweden 160

Page 1 of 2
Organization Disclosed
Ahlqvist & Almqvist Arkitekter AB
Wallstreet
Briab Group AB
Wallstreet
Brunnberg & Forshed Arkitektkontor
Wallstreet
Byrån för Arkitektur och Urbanism
Wallstreet
Danvikshem (Stiftelsen Danviks Hospital)
Wallstreet
Englunds Konsultbyrå AB
Wallstreet
Fab Support AB
Wallstreet
Mantum Holding AB
Wallstreet
Spectrum Arkitekter AB
Wallstreet
Vendus Sweden AB
Wallstreet
Vadeto Group
Qilin
Electro Heat Sweden AB
Rhysida
bakemyday.se
Incransom
bakemyday.se
Incransom
Electrolux 2...
Emperador
Electrolux 2...
Emperador
Markisol
Thegentlemen
Securitas Group
Everest
Securitas Group
Everest
Electrolux
Emperador
Electrolux
Emperador
PayPal support operations (Transcom WorldWide)
N0n
PayPal support operations (Transcom WorldWide)
N0n
Aarsleff
Qilin
Aarsleff
Qilin
Goteborgsregionens Tekniska Gymnasium
Thegentlemen
Goteborgsregionens Tekniska Gymnasium
Thegentlemen
Dustin Group
Fulcrumsec
Dustin Group
Fulcrumsec
Semper Laser
Direwolf
Edacentrum
Panzer
THQ Nordic
Direwolf
Elekta AB
Shinyhunters
avkvalves.com
Settra
Lifesum
Direwolf
Roadvision Systems
Thegentlemen
Wishfully Studios
Direwolf
Axson Teknik
Thegentlemen
Depona
Qilin
Krafman
Thegentlemen
Bonava
Exfilsquad
******.com.se
Section9
Carrier AB
Deadlock
Byggelit Sverige
Thegentlemen
Svensk Direktreklam
Play
Tooltec
Thegentlemen
ONE Contact
Deadlock
Hornavan Hotell
Deadlock
INGKA GROUP
Lapsus$
Areco
Dragonforce
GDL Transport
Worldleaks
Pamil Modulsystem
Dragonforce
Forsheda Stlverktyg
Thegentlemen
dahlgrenscement.se
Safepay
Promotion AB
Dragonforce
Cahbo Produkter
Qilin
Dorotea Sweden
Incransom
Avitrans
Qilin
Friktimporten Stockholm
Thegentlemen
WEDA ROBOTICS
Lamashtu
Brokk
Play
SATS Sports Club Sweden
Thegentlemen
Biogel
Qilin
ATG - New samples added
Coinbasecartel
Bigso
Dragonforce
Hafa
Thegentlemen
Elabs
Rhysida
Hermes Medical Solutions
Termite
Hr Björkmans Entrémattor
Qilin
ATG
Coinbasecartel
www.enea.com
Incransom
Swedish Arts Council
Ransomhouse
CYTIVALIFESCIENCES.COM
Clop
Hydroscand
Akira
University of Gävle
Nova
Micke Stridh Maskin
Qilin
InfraCom Group
Qilin
Svenska Kraftnät
Everest
Polar-studio
Qilin
Repeated Signal Solutions
Qilin
Dynamic Precision Sverige
Qilin
IKEA
Shinyhunters
ekonomipoolen.se/Sweden/32/GB
Kairos
Miljödata (1 day left)
Datacarry
Miljödata
Datacarry
Algorithmica Research
Thegentlemen
Ekmanian Tax & Accounting
Qilin
dafo.se
Chaos
Bondtech
Akira
alpresor.se
Qilin
Scania.com
Teamxxx
HTC_Högtryckscenter_Sweden
Incransom
Sib-Tryck Holding
Akira
T2 Group
Blackbyte
Tara Pac
Akira
entab.se
Global
APH Svenska
Sarcoma
AKJ Energiteknik
Play
Stiga.com
Imncrew
KraftKisarna
Dragonforce

Frequently asked questions

How many ransomware attacks have occurred in Sweden?

Sweden has recorded 160 ransomware victim disclosures in this database, ranking #20 globally. This represents 0.7% of all tracked ransomware attacks worldwide.

Which ransomware groups target Sweden?

The ransomware groups most active in Sweden are Qilin, Thegentlemen, Wallstreet, Play. These groups collectively account for the majority of victim disclosures attributed to Sweden.

Which industries are most targeted by ransomware in Sweden?

In Sweden, the most frequently targeted sectors are Manufacturing, Business Services, Technology. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Sweden rank globally for ransomware attacks?

Sweden ranks #20 globally for ransomware attacks with 160 victim disclosures, representing 0.7% of the worldwide total of 23,674 tracked victims.

How can organisations in Sweden protect against ransomware?

Organisations in Sweden should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Sweden is also recommended.