11 Nightspire Claims Surge in 24 Hours, Targeting US Healthcare and Professional Services

Security teams should be aware of a significant increase in unverified ransomware leak-site postings. Our data desk analysis of public tracking data indicates that 35 claims were published within a 24-hour window. Among the criminal groups involved, Nightspire was the most active, accounting for 11 of these claims. Other groups with multiple claims include Eclipse with five, UmBra with four, and LockBit5 with four. SilentRansomGroup, Storm, netrunner, and qilin also registered claims, with counts ranging from one to three.

The risk

These claims represent unverified statements made by criminal groups on dark web leak sites. The organizations listed as victims have not confirmed whether these claims are accurate or whether data was actually exfiltrated. The surge in volume suggests a period of heightened activity or coordinated posting by several ransomware operators. For security teams, this volume creates noise that can complicate incident response and threat intelligence efforts. The lack of verification means that internal alerts generated by these public claims must be treated as potential indicators rather than confirmed breaches.

Who is exposed

Geographically, the United States faced the highest number of claims, with 11 postings linked to US-based entities. Brazil and India each saw three claims. France and Egypt had two claims each, while Italy had one. By sector, healthcare organizations were the most targeted, with seven claims. Professional services organizations faced six claims, manufacturing five, and education five. The remaining sectors accounted for three claims. This distribution highlights that critical infrastructure and service-heavy industries remain primary targets for ransomware groups seeking high-impact leverage.

Cost and compliance

The source material does not provide specific financial costs associated with these incidents. However, the sectors involved, particularly healthcare and education, are subject to strict regulatory compliance requirements. Unverified claims against these sectors can trigger mandatory breach notification procedures, even before the validity of the claim is determined. Organizations in these sectors must monitor their exposure closely to ensure they can meet reporting deadlines and maintain customer trust. The presence of multiple groups posting simultaneously increases the likelihood of overlapping compliance obligations across different regions.

What should you do?

Security managers should immediately cross-reference the claimed victim names against their own organization's identity. If a match is found, initiate internal incident response protocols to verify system integrity and check for indicators of compromise. Monitor threat intelligence feeds for any additional details regarding the specific ransomware variants mentioned. Do not assume a claim is valid without internal verification, but do not dismiss it as false without investigation.

What to do and how to stay safe: Nightspire

• Monitor ransomware leak sites and threat intelligence feeds for mentions of your organization's name or domain.
• Verify the integrity of your systems by checking for unauthorized access, unusual network traffic, or encrypted files.
• Ensure that your incident response plan includes procedures for handling unverified breach claims.
• Review access logs and endpoint detection data for signs of compromise associated with the mentioned ransomware groups.

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ransomware group is most active in the latest 24-hour tracker data?

Nightspire is the most active group, with 11 unverified claims posted in the last 24 hours.

Which country has the most ransomware leak claims?

The United States has the most claims, with 11 postings linked to organizations in the country.

Which sector is most targeted in the recent data?

The healthcare sector is the most targeted, with seven unverified claims reported.