Threat intelligence · Ransomware
Who Got Hit, And By Whom.
A live tracker of victims that ransomware groups post on their leak sites. Browse groups, search victims, and see which countries and industries are hit.
The tool runs on ATLAS, the free tool site by Brandefense. Opens in a new tab, no signup.
| Victim (masked) | Group | Sector | Country | Status |
|---|---|---|---|---|
| a*****.example | Group A | Manufacturing | US | Claimed |
| b*****.example | Group B | Technology | CA | Claimed |
| c*****.example | Group A | Consulting | UK | Claimed |
| d*****.example | Group C | Healthcare | DE | Claimed |
Sector alert A short email when a company in your sector and country is posted. Part of the platform.
Sample, not live data
What you get
What You See On ATLAS.
Groups
Profiles, activity and targets for each tracked group.
Victims and search
Search victims by company, group or date.
Countries
Where victims are, country by country.
Industries
Which sectors are hit most.
A company check
Type a domain to see whether the company has been listed.
Who it is for
Who Uses The Ransomware Tracker.
- Security teams who want to know which groups hit their sector
- Risk and procurement teams checking whether a supplier was listed
- Journalists and researchers following leak-site activity
On the Brandefense platform
From a tracker to an alert.
The platform can email your team when a company in your sector and country is posted, because the groups that hit your peers often come for you next.
Victim lists are claims posted by the groups. Brandefense analysts validate each claim before it is counted, but a listing is not proof of a breach.