Ransomware Victims Database

This database tracks 16,706 confirmed ransomware victims disclosed publicly by threat actor groups on their dark web leak sites. The data spans attacks from 2024 to 2026, covering 171 countries and 30 industry sectors.

Ransomware groups typically publish victim data on Tor-based leak sites when organizations refuse to pay the ransom. This database aggregates those disclosures to provide threat intelligence professionals, security researchers, and cybersecurity teams with visibility into the ransomware threat landscape. Data is sourced via the ransomware.live API.

The top ransomware groups by victim count are Qilin, Akira, Play, Ransomhub, Clop. Together, these five groups account for 5,335 victims — approximately 32% of all tracked attacks.

The most affected country is United States with 7,026 victims, followed by Canada, Germany, United Kingdom, France. The most targeted industries are Business Services, Manufacturing, Technology, Healthcare.