Threat Group Profile
interlock
● Active — last 30 days
Victim claims
14
First seen
Jan 2026
Last activity
10 Jul 2026
Tracked since
—
Group overview
Interlock is a ransomware group first observed in September 2024 that targets critical infrastructure sectors including healthcare, government, education, and technology across North America and Europe using double-extortion, with 57+ claimed victims including a major US dialysis provider exposing over two million patient records.
Preferred targets
Education · 3
Healthcare · 3
Consumer Services · 2
Transportation/Logistics · 2
Public Sector · 2
Hospitality and Tourism · 1
Most targeted countries
US · 10
CA · 1
AU · 1
IE · 1
PL · 1
