Ransomware Victims Database
Tracking 21,570 confirmed ransomware victims across 177 countries from 234 documented threat groups. Data sourced from dark web leak sites via ransomware.live.
Updated: Sep 14, 2026 08:00 UTC
All Victims (21,570 records, newest first)
Page 1 / 432About This Ransomware Victims Database
This database tracks 21,570 confirmed ransomware victims disclosed publicly by threat actor groups on their dark web leak sites. The data spans attacks from 2024 to 2026, covering 177 countries and 21 industry sectors.
Ransomware groups typically publish victim data on Tor-based leak sites when organizations refuse to pay the ransom. This database aggregates those disclosures to provide threat intelligence professionals, security researchers, and cybersecurity teams with visibility into the ransomware threat landscape. Data is sourced via the ransomware.live API.
The top ransomware groups by victim count are Qilin, Akira, Play, Incransom, Thegentlemen. Together, these five groups account for 6,393 victims — approximately 30% of all tracked attacks.
The most affected country is United States with 9,477 victims, followed by Germany, Canada, United Kingdom, Italy. The most targeted industries are Business Services, Manufacturing, Technology, Healthcare.
Frequently Asked Questions
How many ransomware victims are tracked in this database?
The database currently tracks 21,570 ransomware victims across 177 countries. Data is sourced from ransomware group leak sites and updated every few hours.
Which ransomware group has the most victims?
Qilin is currently the most prolific ransomware group with 2,246 tracked victims. Other highly active groups include Akira, Play, Incransom, Thegentlemen.
Which country has the most ransomware victims?
United States has the most ransomware victims with 9,477 recorded attacks. Use the country filter above or visit individual country profile pages for detailed analysis.
What sectors are most targeted by ransomware?
The most targeted sectors are Business Services, Manufacturing, Technology, Healthcare, Financial Services. These sectors are often targeted because they hold sensitive data and face pressure to restore operations quickly.
Can I filter victims by ransomware group or country?
Yes. Use the filter controls above the victim table to narrow results by ransomware group, country, industry sector, or year. You can also visit dedicated group profile pages (e.g., /ransomware-group/qilin) or country profile pages for in-depth analysis.