See which ransomware gangs are hitting your sector. From their own leak sites.
Ransomware monitoring tracks the gangs that name their victims on leak sites, and every organisation they claim, by sector and country. See which gangs are active and who they are naming in your sector.
What does the tracker show? Who, where and how often.
Ransomware gangs name the organisations they say they have hit, to pressure them into paying. We record those claims so you can see the pattern, not just the headlines.
Ransomware groups
Over 400 groups tracked, of which 76 posted claims in the 30 days to mid-October 2026.
Claimed victims
Over 30,000 organisations named on leak sites, each recorded as a claim.
By sector
Which industries the gangs are naming most, from manufacturing to healthcare.
By country
Where the claimed victims are based, so you can look at the UK or anywhere else.
Most active groups
The gangs posting the most claims recently, at a glance.
Relevant to you
The claims and gangs in the sectors you have told us you work in.
Group profiles
How each group works, the flaws it uses and the sectors it goes after.
Public industry pages
15 industry pages, no account needed, listing the threat groups linked to each.
How does it work? They post. We record. You look.
There is nothing to install and nothing to connect. The tracker is built from what the gangs publish about themselves.
- On a leak site
A gang names a victim
Ransomware groups publish the organisations they claim to have hit, usually to pressure them into paying.
- In the tracker
We record the claim
Each claim is recorded against the group that posted it, with the organisation's sector and country.
- Whenever you look
You filter and compare
See the most active groups, or filter every claim by group, sector and country.
- On your dashboard
Your sectors, first
Pick the sectors you work in and the gangs naming businesses like yours sit on your dashboard.
Who is hitting your sector? Pick one and see.
Each sector has its own most active gangs, and they change. Choose the sectors you work in and your dashboard shows the claims among your peers and the groups behind them.
- Claims in your sectors, and how many groups are behind them.
- The gangs most active against businesses like yours, so you know which names to read up on.
- Every sector and country, not just your own, when you want the wider picture.
Browsing without an account? Our public industry pages list the threat groups linked to each of 15 industry groups.
My industries · Ransomware
Ransomware claims by sector over the 30 days to mid-October 2026. Choose a sector to see the groups making the most claims against it. Acme tracks manufacturing and industrial, so that sector is marked as relevant.
Claims in the last 30 days · Mid-October 2026
Relevant to you: Acme tracks this sector
- Qilin19
- The Gentlemen12
- Akira10
- Emperador7
- Lamashtu5
Who have they claimed? Filter every claim.
Every claim we record sits in one searchable list. Narrow it to a group, a sector or a country and see who has been named, and when.
- Filter by group, sector and country to see the claims that matter to you.
- Open the group behind a claim to see how it works and which flaws it uses.
- Claims, not confirmed breaches. A gang posting a name is a strong signal, but it is the gang's word.
Group profiles, techniques and the flaws each gang uses live in threat intelligence.
Victims · Group · Sector · Country
A website run by a ransomware gang where it names the organisations it claims to have attacked, often with a threat to publish stolen data, to pressure them into paying.
No. A claim is what the gang has posted on its own site. We record it as a claim, so treat it as a strong signal rather than proof of what happened.
Over 400 ransomware groups and over 30,000 victim claims. In the 30 days to mid-October 2026, 76 groups posted 825 claims.
Yes. Pick the sectors you work in and your dashboard shows the ransomware claims and gangs in those sectors. You can still filter every claim by group, sector and country.
No. The tracker is something you browse. Our alerts cover flaws in the software you track, lookalike domains, certificates and dependency files, not ransomware claims.
To see your own sectors, yes. Without one, you can still browse our public threat group and industry pages.
Know what is hitting your peers. Sector by sector.
Choose your sectors and see which of the 400-plus gangs we track are naming victims like you, who they have claimed and where, across every sector and country.