Ransomware Victims Database
Tracking 18,041 confirmed ransomware victims across 177 countries from 193 documented threat groups. Data sourced from dark web leak sites via ransomware.live.
Updated: May 23, 2026 18:01 UTC
Most Recent Victims (500 cached ยท 18,041 total)
Page 1 / 10About This Ransomware Victims Database
This database tracks 18,041 confirmed ransomware victims disclosed publicly by threat actor groups on their dark web leak sites. The data spans attacks from 2024 to 2026, covering 177 countries and 15 industry sectors.
Ransomware groups typically publish victim data on Tor-based leak sites when organizations refuse to pay the ransom. This database aggregates those disclosures to provide threat intelligence professionals, security researchers, and cybersecurity teams with visibility into the ransomware threat landscape. Data is sourced via the ransomware.live API.
The top ransomware groups by victim count are Qilin, Akira, Play, Ransomhub, Incransom. Together, these five groups account for 5,630 victims โ approximately 31% of all tracked attacks.
The most affected country is United States with 8,333 victims, followed by Canada, United Kingdom, Germany, Italy. The most targeted industries are Business Services, Manufacturing, Technology, Healthcare.
Frequently Asked Questions
How many ransomware victims are tracked in this database?
The database currently tracks 18,041 ransomware victims across 177 countries. Data is sourced from ransomware group leak sites and updated every few hours.
Which ransomware group has the most victims?
Qilin is currently the most prolific ransomware group with 1,804 tracked victims. Other highly active groups include Akira, Play, Ransomhub, Incransom.
Which country has the most ransomware victims?
United States has the most ransomware victims with 8,333 recorded attacks. Use the country filter above or visit individual country profile pages for detailed analysis.
What sectors are most targeted by ransomware?
The most targeted sectors are Business Services, Manufacturing, Technology, Healthcare, Financial Services. These sectors are often targeted because they hold sensitive data and face pressure to restore operations quickly.
Can I filter victims by ransomware group or country?
Yes. Use the filter controls above the victim table to narrow results by ransomware group, country, industry sector, or year. You can also visit dedicated group profile pages (e.g., /ransomware-group/qilin) or country profile pages for in-depth analysis.