Ransomware Groups

Where these numbers come from

Ransomware groups run leak sites to name the organizations they’ve attacked. We monitor those sites. When a group posts a new victim it lands in our data within a day, and these pages update from it.

Some victims pay and get removed from the site. Others were never breached the way the group says.

Active, quiet and dark

A group is active if it has posted a victim in the last 90 days. Quiet means nothing for 90 days, and dark means nothing for a year.

Quiet doesn’t mean gone. Groups go dormant and come back under a new name, so we keep tracking a site after it stops publishing. Dark groups stay listed because their old victims still matter. The data those attacks leaked is still circulating, and it still turns up years later.