Live Ransomware Attack Map

Real-time global ransomware activity tracking and threat intelligence visualization

Last updated: Feb 13, 2026 12:01
15,321
Total Victims
169
Countries Affected
168
Active Groups
30
Targeted Sectors
Filters:

Loading map data...

Top Ransomware Groups

1 Qilin 1,415
2 Akira 1,147
3 Ransomhub 844
4 Play 809
5 Clop 711
6 Incransom 617
7 Lockbit3 578
8 Safepay 436
9 Lynx 384
10 Medusa 368

Top Targeted Sectors

Monthly Attack Trend

Top 15 Ransomware Groups

Attack Heatmap (Months x Years)

Recent Victims

Victim Country Group Sector Date

About the Ransomware Attack Map

This interactive map provides real-time visualization of 15,321 global ransomware attacks across 169 countries, tracked from 168 active ransomware groups. Data is collected from ransomware group leak sites and dark web intelligence sources, updated every 6 hours.

Use the filters above to explore attacks by specific ransomware groups (such as Qilin, Akira, Ransomhub), targeted business sectors, or geographic regions. Hover over any country to see detailed statistics including victim counts, active threat groups, and recent incidents.

The monthly trend chart and heatmap provide historical context, showing how ransomware activity has evolved over time. This data is sourced from ransomware.live API.

Frequently Asked Questions

How many ransomware attacks have been recorded?

Our dataset currently tracks 15,321 ransomware attack victims across 169 countries. This data is updated every 6 hours from dark web leak site monitoring and open-source threat intelligence feeds.

Which ransomware group is the most active?

Qilin is currently the most active ransomware group in our dataset. We track 168 active ransomware groups with unique color coding on the interactive map for easy identification.

Which country is most targeted by ransomware?

United States is the most frequently targeted country by ransomware attacks. Use the interactive map to explore attack distribution across all 169 affected countries.

How often is the ransomware map data updated?

The ransomware attack data is automatically updated every 6 hours. The data is sourced from ransomware.live API which monitors ransomware group leak sites on the dark web and aggregates victim disclosures.

What sectors are most targeted by ransomware?

Healthcare, manufacturing, education, government, and financial services are among the most targeted sectors. Use the sector filter on the map to explore attacks by industry.

Can I filter ransomware attacks by group or country?

Yes. The interactive map supports filtering by ransomware group, business sector, and time period. Click any country on the map to view detailed attack statistics, or use the dropdown filters above the map.