Ransomware activity in Sweden
35
Public victims
8
Active groups
8
Sectors hit
Source: Ransomware.live
Most active groups
Wallstreet (10) thegentlemen (8) direwolf (4) qilin (3) emperador (2) Booba Project (1) everest (1) settra (1)
Most affected sectors
Manufacturing (9) Professional Services (6) Other (4) Technology (4) Healthcare (4) Not Found (2) Retail & E-Commerce (1) Energy & Utilities (1)
Recently listed organizations
| Organization | Sector | Listed |
|---|---|---|
| Vetstoria | Healthcare | 2026-11-03 |
| Pac Production | Other | 2026-10-31 |
| Malmsten | Other | 2026-10-31 |
| Svedala Kommun | Government & Defense | 2026-10-31 |
| Ahlqvist & Almqvist Arkitekter AB | Professional Services | 2026-10-13 |
| Englunds Konsultbyrå AB | Professional Services | 2026-10-13 |
| Spectrum Arkitekter AB | Professional Services | 2026-10-13 |
| Vendus Sweden AB | Other | 2026-10-13 |
| Fab Support AB | Manufacturing | 2026-10-13 |
| Byrån för Arkitektur och Urbanism | Professional Services | 2026-10-13 |
| Briab Group AB | Not Found | 2026-10-13 |
| Danvikshem (Stiftelsen Danviks Hospital) | Healthcare | 2026-10-13 |
| Brunnberg & Forshed Arkitektkontor | Professional Services | 2026-10-13 |
| Mantum Holding AB | Other | 2026-10-13 |
| Vadeto Group | Not Found | 2026-10-09 |
| Electro Heat Sweden AB | Energy & Utilities | 2026-10-02 |
| bakemyday.se | Retail & E-Commerce | 2026-09-28 |
| Electrolux 2... | Manufacturing | 2026-09-28 |
| Markisol | Manufacturing | 2026-09-26 |
| Securitas Group | Professional Services | 2026-09-25 |
| Electrolux | Manufacturing | 2026-09-19 |
| PayPal support operations (Transcom WorldWide) | Financial Services | 2026-09-18 |
| Aarsleff | Manufacturing | 2026-09-16 |
| Goteborgsregionens Tekniska Gymnasium | Education | 2026-09-15 |
| Dustin Group | Technology | 2026-09-11 |
Is your domain exposed?
Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.
Get your free reportAll information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.