Business & Professional Services — Cyber Threat Activity

Business and professional services is the most-claimed sector in our incident log, spanning consultancies, accountancies, staffing firms, marketing agencies and managed service providers. More than 2,900 incidents are recorded against it across 88 countries, with over 750 falling in the trailing 180 days, and 99 distinct groups have been attributed at least one. Almost none of that is espionage. It is extortion, and the concentration is severe: LockBit (198 claims), Akira (196), Qilin (187), RansomHub (187) and Play (164) lead a field dominated by ransomware crews rather than state actors. The selection logic is opportunity, not strategy. These firms hold client material drawn from every other sector, run comparatively lean IT, and price downtime in billable hours, which makes them both a payday and a route onward. Managed service providers convert a single intrusion into many, so a services compromise is frequently the first event in a cluster of otherwise unrelated victims. Recorded geography is heavily United States (1,819 claims), then the United Kingdom, Canada, Germany, France and Australia, but that distribution reflects where extortion operators choose to name victims rather than where intrusions happen. Read these totals as attacker assertions: a leak-site post is a claim, published to apply pressure, and victims who pay are quietly removed from the sites we collect, so the visible population skews toward those who refused. The defensive implication is unglamorous. The crews named above overwhelmingly enter through valid credentials on remote access and unpatched internet-facing appliances, not novel malware, and the professional-services firm that survives is the one that treats its client data as someone else's crown jewels.

All sectors

Recent incidents

Threat actors targeting Business & Professional Services

Where these victims are

Malware used against Business & Professional Services

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions