Ransomware intelligence
Ransomware threat database
Track 410+ ransomware groups: victims claimed on their leak sites, targeted sectors and countries, known IOCs.
- Active groups
- 410
- Total victims
- 32 848
- Attacks this month
- 625
- Attacks this year
- 8 262
Exposure check
Check your domain against leak sites
The report flags domains named as victims on the leak sites we track.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request
Groups
Active ransomware groups by victim count.
Top 20 of 410 tracked groups.
1Qilin2,378 victims2LockBit 3.02,016 victims3Akira1,644 victims4Play1,333 victims5CL0P1,302 victims6LockBit 2.01,002 victims7Thegentlemen998 victims8INC Ransom977 victims9RansomHub842 victims10ALPHV Blackcat731 victims11DragonForce663 victims12SafePay594 victims13BianLian552 victims14Black Basta523 victims15Medusa517 victims168Base455 victims17Lynx417 victims18Everest412 victims19LockBit 5.0383 victims20Nightspire361 victims
Victimology
Where attacks land by sector and country.
Most targeted sectors
- 01business-services6127 attacks
- 02manufacturing5732 attacks
- 03technology4106 attacks
- 04healthcare2779 attacks
- 05retail2262 attacks
- 06financial-services1850 attacks
- 07unknown1539 attacks
- 08transportation1499 attacks
- 09education1415 attacks
- 10agriculture1350 attacks
Most targeted countries
- 01US10657 victims
- 028206 victims
- 03GB1150 victims
- 04DE1124 victims
- 05CA1114 victims
- 06IT729 victims
- 07FR703 victims
- 08BR604 victims
- 09IN561 victims
- 10AU537 victims
Coverage
What the ransomware data covers and where it stops.
- Covered entities
- Groups, victim organizations, sectors, countries, leak-site activity and related infrastructure.
- Refresh
- Source data is fetched on demand; this page refreshes every hour.
- API access
- Dashboard views plus API routes for feeds, groups, press and sector risk.
- Limitations
- A leak-site listing is a risk signal, not attribution. Verify before any disclosure.
Track ransomware activity in your sector
Group and sector views in the dashboard, and the IOC feed by API.
Explore