Ransomware Victims Database
Tracking 19,472 confirmed ransomware victims across 175 countries from 205 documented threat groups. Data sourced from dark web leak sites via ransomware.live.
Updated: Jul 19, 2026 06:00 UTC
Most Recent Victims (500 cached ยท 19,472 total)
Page 1 / 10About This Ransomware Victims Database
This database tracks 19,472 confirmed ransomware victims disclosed publicly by threat actor groups on their dark web leak sites. The data spans attacks from 2024 to 2026, covering 175 countries and 15 industry sectors.
Ransomware groups typically publish victim data on Tor-based leak sites when organizations refuse to pay the ransom. This database aggregates those disclosures to provide threat intelligence professionals, security researchers, and cybersecurity teams with visibility into the ransomware threat landscape. Data is sourced via the ransomware.live API.
The top ransomware groups by victim count are Qilin, Akira, Play, Ransomhub, Incransom. Together, these five groups account for 5,952 victims โ approximately 31% of all tracked attacks.
The most affected country is United States with 8,759 victims, followed by Canada, United Kingdom, Germany, Italy. The most targeted industries are Business Services, Manufacturing, Technology, Healthcare.
Frequently Asked Questions
How many ransomware victims are tracked in this database?
The database currently tracks 19,472 ransomware victims across 175 countries. Data is sourced from ransomware group leak sites and updated every few hours.
Which ransomware group has the most victims?
Qilin is currently the most prolific ransomware group with 1,977 tracked victims. Other highly active groups include Akira, Play, Ransomhub, Incransom.
Which country has the most ransomware victims?
United States has the most ransomware victims with 8,759 recorded attacks. Use the country filter above or visit individual country profile pages for detailed analysis.
What sectors are most targeted by ransomware?
The most targeted sectors are Business Services, Manufacturing, Technology, Healthcare, Financial Services. These sectors are often targeted because they hold sensitive data and face pressure to restore operations quickly.
Can I filter victims by ransomware group or country?
Yes. Use the filter controls above the victim table to narrow results by ransomware group, country, industry sector, or year. You can also visit dedicated group profile pages (e.g., /ransomware-group/qilin) or country profile pages for in-depth analysis.