Leak-site monitoring
Ransomware Victims Tracker
Leak-site posts · 2022 → present
Ransomware groups attack organisations worldwide, causing personal data breaches in many of them. This is a searchable list of organisations published on gang leak sites, refreshed three times a day from Ransomware.live.
Law enforcement and IT security companies have joined forces to disrupt cybercriminal businesses with ransomware connections. The No More Ransom initiative helps victims recover encrypted data without paying criminals.
Latest ransomware victim posts
Export tip: hide pagination before exporting to capture the full list.
| Post | Group | Date | Country | Screenshot |
|---|
Explore ransomware victims
303 groups · 188 countries · 12 sectorsMost active groups
- Qilin 2,378
- Lockbit3 2,016
- Akira 1,644
- Play 1,333
- Clop 1,298
- Thegentlemen 998
- Incransom 977
- Ransomhub 842
- Alphv 717
- Dragonforce 663
- Safepay 594
- Lockbit2 573
- Bianlian 552
- Blackbasta 523
- Medusa 517
Most affected countries
- United States 10,491
- United Kingdom 1,132
- Germany 1,108
- Canada 1,088
- Italy 714
- France 681
- Brazil 588
- India 550
- Australia 518
- Spain 514
- Japan 342
- Mexico 319
- Switzerland 248
- Taiwan 232
- Thailand 220
Most affected sectors
- Professional Services 5,833
- Manufacturing 5,372
- Technology 3,862
- Healthcare 2,652
- Retail & E-Commerce 2,100
- Financial Services 1,745
- Transportation 1,405
- Education 1,331
- Agriculture and Food Production 1,260
- Government & Defense 1,237
- Energy & Utilities 926
- Hospitality 832
About this tracker
What is a ransomware leak site?
Most ransomware gangs run double-extortion operations: they steal data before encrypting systems, then publish the victim's name on a data leak site (DLS), usually hosted on Tor, to pressure it into paying. If no ransom is paid, the stolen files are often released there.
Where does the data come from?
Posts are collected from ransomware.live, which monitors hundreds of leak sites. This tracker fetches its API three times a day (06:33, 12:33 and 18:33 UTC), adds country and group information, and publishes the result as this table, pages per group, country and sector, a JSON dataset and an Atom feed.
Are the listings verified?
No. A post is a claim made by a criminal group. Some gangs exaggerate, re-post old breaches or list organisations they never compromised. Treat each entry as an indicator that needs confirmation, not as proof of a breach.
My organisation is listed — what now?
Contact your incident response provider and your national CERT or CSIRT, and report the incident to law enforcement. If personal data may be affected, check your breach-notification duties, for example under the GDPR. Before paying anything, look for free decryptors on No More Ransom.
Can I reuse the data?
Yes. Download the full JSON dataset or the last 30 days, subscribe to the Atom feed, or read the source code on GitHub. Please credit ransomware.live as the original source.