Live Ransomware Attack Map

Real-time global ransomware activity tracking and threat intelligence visualization

Last updated: May 23, 2026 18:01
18,041
Total Victims
177
Countries Affected
193
Active Groups
15
Targeted Sectors
Filters:

Loading map data...

Top Ransomware Groups

1 Qilin 1,804
2 Akira 1,329
3 Play 896
4 Ransomhub 842
5 Incransom 759
6 Clop 740
7 Lockbit3 578
8 Dragonforce 499
9 Safepay 479
10 Thegentlemen 427

Top Targeted Sectors

Monthly Attack Trend

Top 15 Ransomware Groups

Attack Heatmap (Months x Years)

Recent Victims

Victim Country Group Sector Date

About the Ransomware Attack Map

This interactive map provides real-time visualization of 18,041 global ransomware attacks across 177 countries, tracked from 193 active ransomware groups. Data is collected from ransomware group leak sites and dark web intelligence sources, updated every 6 hours.

Use the filters above to explore attacks by specific ransomware groups (such as Qilin, Akira, Play), targeted business sectors, or geographic regions. Hover over any country to see detailed statistics including victim counts, active threat groups, and recent incidents.

The monthly trend chart and heatmap provide historical context, showing how ransomware activity has evolved over time. This data is sourced from ransomware.live API.

Frequently Asked Questions

How many ransomware attacks have been recorded?

Our dataset currently tracks 18,041 ransomware attack victims across 177 countries. This data is updated every 6 hours from dark web leak site monitoring and open-source threat intelligence feeds.

Which ransomware group is the most active?

Qilin is currently the most active ransomware group in our dataset. We track 193 active ransomware groups with unique color coding on the interactive map for easy identification.

Which country is most targeted by ransomware?

United States is the most frequently targeted country by ransomware attacks. Use the interactive map to explore attack distribution across all 177 affected countries.

How often is the ransomware map data updated?

The ransomware attack data is automatically updated every 6 hours. The data is sourced from ransomware.live API which monitors ransomware group leak sites on the dark web and aggregates victim disclosures.

What sectors are most targeted by ransomware?

Healthcare, manufacturing, education, government, and financial services are among the most targeted sectors. Use the sector filter on the map to explore attacks by industry.

Can I filter ransomware attacks by group or country?

Yes. The interactive map supports filtering by ransomware group, business sector, and time period. Click any country on the map to view detailed attack statistics, or use the dropdown filters above the map.