Skip to main content
Groups · ransomware operators we track

495 ransomware operators,
116 of them posting right now.

Every actor that has claimed a victim on a public leak site, with sector focus, country breakdown, and time-since-last-post. An operator counts as active while it has posted a disclosure in the last 60 days.

Of 495 tracked operators, 116 have posted a disclosure in the last 60 days. LockBit leads with 6,924 claimed victims, and Business Services is the most-targeted industry.

Sort by

Top by claimed victims

All operators

Showing the top 100 of 486.