Threat actor analysis
Fulcrumsec has disclosed 30 victims on its leak site, 0.1% of all ransomware listings tracked in this database. Its earliest disclosure here dates to May 2026.
The group has listed organisations in 13 countries, most often in United States (14 victims), followed by United Kingdom, India, Sweden.
By industry, its listings concentrate in Technology, Business Services, Healthcare — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.
Like most current ransomware operations, Fulcrumsec is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.