Greetings, Cybersecurity Enthusiasts!
April sustained elevated breach volume, though overall activity declined from March’s peak. Ransomware and defacements remained the largest sources of breach activity, while Europe gained share and manufacturing moved into the top impacted industry position. Here is what defined the month.
📊 Cyber Incidents Breakdown
Across all monitored sources, we recorded 1,966 breaches in April, down from 2,221 in March. Ransomware remained a leading driver of high-impact events alongside persistent defacement activity and continued public reporting.
Source Mix
- Ransomware Posts: 732 (↓ from 813)
- Defacements: 766 (↓ from 940)
- Hacker Forums: 190 (↑ from 189)
- News Coverage: 199 (↑ from 183)
- Official Reports: 73 (↓ from 93)
- SEC Filings: 5 (↑ from 2)
- Leak Reports: 1 (no change)
💥 Most Active Ransomware Gangs
The most prolific ransomware groups in April were:
- Qilin — 109 victims (↓ from 139)
- Gentleman — 67 victims (↓ from 74)
- DragonForce — 64 victims (↑ from 57)
- Akira — 51 victims (↓ from 82)
- Coinbase — 40 victims (↑ from 24)
Qilin remained the clear ransomware leader despite a month-over-month decline. DragonForce continued to climb, while Coinbase entered the top five with a notable increase in activity.
🆕 Enhanced Ransomware Gang Tracking
HackNotice expanded intelligence coverage for the following groups due to increased activity and infrastructure visibility:
- Mnt6
- Aurora
- M3rx
- Leakbazaar
- Shadowbyte
- Prinzeugen
- Lamashtu
- Blackwater
- Timc
- Auditteam
- Cryo
- Shadowbytes
📰 Breaches That Made the News
Several high-profile breaches captured attention in April:
- SAP: https://app.hacknotice.com/#/hack/69f28c21de7caace1977718b
- ClickUp: https://app.hacknotice.com/#/hack/69f09a0fde7caace19fa5a7c
- Bank of Scotland: https://app.hacknotice.com/#/hack/69f14afe73aca07140f01d93
- Bitwarden: https://app.hacknotice.com/#/hack/69ea73a6de7caace19450cbe
- Seiko USA: https://app.hacknotice.com/#/hack/69e67115de7caace195d6067
🏭 Industry and Geography Insights
Industries Most Impacted
- Manufacturing: 15.7% (↑ from 14.3%)
- Professional, Scientific, and Technical Services: 14.9% (↓ from 15.6%)
- Information: 8.2% (↓ from 9.2%)
- Construction: 7.6% (↓ from 10.5%)
- Health Care and Social Assistance: 7.6% (↑ from 3.8%)
Industry Trends
- Manufacturing moved into the top position, reflecting increased attacker focus on operational disruption and supply-chain leverage.
- Professional services remained heavily targeted but lost share month-over-month.
- Healthcare doubled its share from March, signaling renewed pressure on sensitive data and high-impact service environments.
🌍 Regions Most Affected
- North America: 50.5% (↓ from 54.1%)
- Europe: 26.3% (↑ from 23.8%)
- Asia: 9.3% (↑ from 8.9%)
- South America: 4.8% (↓ from 5.1%)
- Middle East: 3.9% (↓ from 4.0%)
- Africa: 2.6% (↑ from 2.4%)
- Oceania: 2.5% (↑ from 1.7%)
Regional Trends
- North America remained the largest concentration of ransomware activity, but its share continued to decline.
- Europe gained share for the second month in a row, reinforcing its position as a growing ransomware hotspot.
- Activity continued to diversify globally, with Asia, Africa, and Oceania all increasing share.
✅ Closing Thoughts
April showed a slight cooldown from March’s breach surge, but ransomware remained highly active and geographically broad. Manufacturing rose to the top impacted industry, Europe continued gaining share, and DragonForce and Coinbase increased their presence among the most active ransomware groups.
🔍 If you are not tracking ransomware’s role in third-party exposure, you are missing a critical blind spot.
Stay ahead of shifting threats with HackNotice’s real-time intelligence across ransomware, breaches, and dark-web activity.
👉 Request a demo to see how HackNotice helps you manage third-party risk.
