Ransomware Tracker v2 — Multi-Source Live Threat Map
Ransomware groups run "double extortion" leak sites — dark-web pages where they name victims and publish stolen data as proof. This tracker aggregates those claims across multiple independent community APIs into one live view: a worldwide attack map, victim search, group profiles with leak-site metadata, infostealer corroboration and 30-day activity trends.
Every 2MNY security scan checks your domain against this dataset automatically — run a free scan to see if your organisation has been named.
Global Victim Distribution
Darker = more claimed victims (all sources). Click a country to filter the tables below.
Global Attack Map
Attack dots by country — filter by timeframe or reporting source; click a dot for details.
Claims per day — last 30 days
All sources combined. Hover a bar for the exact date and count.
Top countries
By tracked victims across all sources
| Date | Victim | Group | Country | Sector | Source |
|---|
Most Active Ransomware Groups
By number of tracked leak-site victims (all sources)
Intelligence sources
Free, community-run APIs aggregated hourly with strict per-source rate discipline. Every claim in the tracker is tagged with the source that reported it.
| Source | What we aggregate | Cadence | Claims indexed | Last sync |
|---|---|---|---|---|
| Ransomware.live↗ | Groups directory + victim claims + cyberattack feed | hourly / daily | 11,045 | 4 minutes ago |
| RansomLook↗ | Recent leak posts + group names + onion-site metadata | hourly / daily | 101 | 2 hours ago |
| RansomFeed↗ | Victim claims with city / region / sector + site row-hash | hourly | 100 | 3 hours ago |
| Ransomwhe.re↗ | Victim + group exports (token-gated: free token pending registration) | awaiting token | 0 | — |
What is ransomware leak-site tracking?
Modern ransomware operations rarely just encrypt files. They steal data first, then run a "leak site" — a dark-web page where each victim gets a countdown: pay, or your stolen documents are published. Being named on a leak site is public proof that an organisation was breached, and it carries regulatory consequences (GDPR Article 33 notification duties, sector rules, customer disclosure), brand damage, and often a second wave of attacks from other gangs who target known victims.
This tracker aggregates leak-site claims from multiple community-maintained APIs — ransomware.live, RansomLook and RansomFeed — and refreshes them hourly. Where several sources report the same claim, both rows are kept: cross-source corroboration is a feature, and every row is tagged with its source. Because claims include victim domains, every 2MNY security scan cross-checks the scanned website against the dataset — turning global threat intelligence into a per-domain answer: has this organisation been named by a ransomware group?
Security teams use this page for situational awareness (which sectors and countries are being hit), for due-diligence checks on partners and vendors, and as a free early-warning resource. Continuous-monitoring customers get the same check automatically, every hour, against their own domains.
Frequently asked questions
Where does the tracker data come from?
Leak-site claims are aggregated from multiple community-tracked APIs — principally the ransomware.live project (which monitors double-extortion leak sites via the Tor network), plus RansomLook and RansomFeed. Each claim is tagged with its source, and all feeds are mirrored into the 2MNY platform hourly. The mirror approach means our scans never touch the dark web — checks run against a local, privacy-safe copy. Infostealer corroboration comes from Hudson Rock's free OSINT tooling.
My domain appears on the tracker. What should I do?
Treat it as a probable security incident: activate your incident-response plan, determine what data was exfiltrated, assess legal notification obligations, hunt for the initial-access vector across the whole organisation (not just the website), rotate credentials and review backups. A 2MNY deep scan is a good first technical step for the web-facing side.
Does a listing mean the website itself was hacked?
Not necessarily. Ransomware usually compromises the corporate network (via phishing, exposed services or credential theft) rather than the public website. The website may be perfectly healthy while the organisation behind it was breached. That is why the finding is framed as incident-response intelligence rather than a website vulnerability.
How current is the data?
All victim feeds refresh hourly (staggered per source); the group directories sync daily and historical backfill runs weekly. Groups often list victims days or weeks after the actual intrusion, so an absence of claims is an assurance signal, not proof of no breach — pair it with technical scanning.
Why do some incidents appear twice?
When two independent sources report the same claim we keep both rows, each tagged with its source — it is a corroboration signal, not a bug. The source chips above the tables let you view a single source at a time.
Is the tracker free?
Yes — this page is a free public resource, and the domain leak-site check is included in every 2MNY scan, including the free tier. Continuous monitoring customers get hourly automatic re-checks with alerting.
Has your organisation been named?
Run a free 2MNY security scan — it includes the ransomware leak-site check plus 276 more security tests.
Scan My Website — Free