Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
TN

Ransomware attacks in Tunisia

24 organisations in Tunisia have been listed on ransomware leak sites, ranking #59 worldwide. Updated .

Victims
24
0.1% of global total
Global rank
#59
of 185 countries
Active groups
17
Most: Hunters
Sectors
9
Most: Manufacturing

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Tunisia. Figures are computed from the tracked records, not inferred.

Tunisia has recorded 24 ransomware attacks globally ranking 58th, with Hunters and Thegentlemen being among the most active groups targeting Manufacturing and Healthcare sectors.

Tunisia in the global picture

Tunisia accounts for 24 of the ransomware disclosures tracked here, ranking #59 worldwide and making up 0.1% of the global total. The sectors listed most often are Manufacturing, Healthcare, Transportation/Logistics.

Who is most active in Tunisia

Hunters — 4 victims in Tunisia. Thegentlemen — 3 victims in Tunisia. N0n — 2 victims in Tunisia.

Ransomware threat profile: Tunisia

Tunisia ranks #59 worldwide for ransomware disclosures, with 24 victims in this database — 0.1% of the global total. The groups listing the most organisations here are Hunters, Thegentlemen and N0n.

The most frequently listed industries in Tunisia are Manufacturing, Healthcare, Transportation/Logistics. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Tunisia's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Tunisia 24

Organization Disclosed
PROTEX Confection
N0n
Company #97
N0n
tnmed.org
Lockbit5
clc-tn.com
Settra
monoprix.tn
Stormous
Bouri Group
Thegentlemen
CRIT Tunisie
Titan
SETCAR
Thegentlemen
Kpropha
Thegentlemen
Hopital La Rabta
Qilin
Hopital La Rabta
Devman
Hopital ** *****
Devman
Alios Finance Group
Incransom
International Freight & Commerce
Direwolf
Natilait
Cicada3301
Squeezer-software
Fog
www.groupe-setcar.com.tn
Ransomhub
Smart-it-partner
Funksec
ExcelPlast Tunisie
Orca
maxcess-logistics.com
Killsec
ATL Leasing
Hunters
ATL
Hunters
SOPEM
Hunters
SOPEM Tunisie
Hunters

Frequently asked questions

How many ransomware attacks have occurred in Tunisia?

Tunisia has recorded 24 ransomware victim disclosures in this database, ranking #59 globally. This represents 0.1% of all tracked ransomware attacks worldwide.

Which ransomware groups target Tunisia?

The ransomware groups most active in Tunisia are Hunters, Thegentlemen, N0n, Devman. These groups collectively account for the majority of victim disclosures attributed to Tunisia.

Which industries are most targeted by ransomware in Tunisia?

In Tunisia, the most frequently targeted sectors are Manufacturing, Healthcare, Transportation/Logistics. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Tunisia rank globally for ransomware attacks?

Tunisia ranks #59 globally for ransomware attacks with 24 victim disclosures, representing 0.1% of the worldwide total of 24,192 tracked victims.

How can organisations in Tunisia protect against ransomware?

Organisations in Tunisia should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Tunisia is also recommended.