Ransomware Victims Database
Tracking 21,758 confirmed ransomware victims across 178 countries from 237 documented threat groups. Data sourced from dark web leak sites via ransomware.live.
Updated: Sep 19, 2026 18:00 UTC
All Victims (21,758 records, newest first)
Page 133 / 436About This Ransomware Victims Database
This database tracks 21,758 confirmed ransomware victims disclosed publicly by threat actor groups on their dark web leak sites. The data spans attacks from 2024 to 2026, covering 178 countries and 21 industry sectors.
Ransomware groups typically publish victim data on Tor-based leak sites when organizations refuse to pay the ransom. This database aggregates those disclosures to provide threat intelligence professionals, security researchers, and cybersecurity teams with visibility into the ransomware threat landscape. Data is sourced via the ransomware.live API.
The top ransomware groups by victim count are Qilin, Akira, Play, Incransom, Thegentlemen. Together, these five groups account for 6,468 victims — approximately 30% of all tracked attacks.
The most affected country is United States with 9,536 victims, followed by Germany, Canada, United Kingdom, Italy. The most targeted industries are Business Services, Manufacturing, Technology, Healthcare.
Frequently Asked Questions
How many ransomware victims are tracked in this database?
The database currently tracks 21,758 ransomware victims across 178 countries. Data is sourced from ransomware group leak sites and updated every few hours.
Which ransomware group has the most victims?
Qilin is currently the most prolific ransomware group with 2,273 tracked victims. Other highly active groups include Akira, Play, Incransom, Thegentlemen.
Which country has the most ransomware victims?
United States has the most ransomware victims with 9,536 recorded attacks. Use the country filter above or visit individual country profile pages for detailed analysis.
What sectors are most targeted by ransomware?
The most targeted sectors are Business Services, Manufacturing, Technology, Healthcare, Financial Services. These sectors are often targeted because they hold sensitive data and face pressure to restore operations quickly.
Can I filter victims by ransomware group or country?
Yes. Use the filter controls above the victim table to narrow results by ransomware group, country, industry sector, or year. You can also visit dedicated group profile pages (e.g., /ransomware-group/qilin) or country profile pages for in-depth analysis.