Privacy UnpackedUpdated hourly
The ransomware claim ledger
Every leak-site claim the tracker has followed since 28 October 2026, and what became of it: confirmed by the organisation or an authority, reported by the news, or still only the gang’s word.
- Claims followed
- 657
- Backed up so far
- 3
- Of claims 30+ days old
- –
- Median days to back-up
- 5
Of the 0 claims made at least 30 days ago, 0 have been backed up: 0 confirmed by the organisation or an authority and 0 reported by the news. Official notices often come months after an attack, so these shares grow as claims age; read them as “so far”, not as a final rate.
By gang
| Gang | Claims followed | 30+ days old | Backed up | Confirmed | Median days |
|---|---|---|---|---|---|
| thegentlemen | 96 | 0 | – | – | – |
| incransom | 63 | 0 | – | – | – |
| qilin | 46 | 0 | – | – | – |
| akira | 28 | 0 | – | – | – |
| N0n | 26 | 0 | – | – | – |
| SilentRansomGroup | 25 | 0 | – | – | 16 |
| medusalocker | 20 | 0 | – | – | – |
| safepay | 20 | 0 | – | – | – |
| Climax Inc | 17 | 0 | – | – | – |
| settra | 17 | 0 | – | – | – |
| Booba Project | 16 | 0 | – | – | – |
| interlock | 13 | 0 | – | – | – |
| rhysida | 13 | 0 | – | – | – |
| Vortex | 13 | 0 | – | – | – |
| BrainCipher | 12 | 0 | – | – | – |
| genesis | 12 | 0 | – | – | – |
| play | 11 | 0 | – | – | – |
| Aoqin | 10 | 0 | – | – | – |
| Curious Worm | 10 | 0 | – | – | – |
| payload | 10 | 0 | – | – | – |
| metaencryptor | 9 | 0 | – | – | – |
| Orova | 9 | 0 | – | – | – |
| krybit | 8 | 0 | – | – | – |
| lockbit5 | 8 | 0 | – | – | – |
| osiris | 8 | 0 | – | – | – |
| Vexy Ransomware | 8 | 0 | – | – | – |
| Dark Project | 7 | 0 | – | – | – |
| Scarlettgroup | 7 | 0 | – | – | – |
| Whitearmor | 7 | 0 | – | – | 5 |
| BYOD | 6 | 0 | – | – | – |
| emperador | 6 | 0 | – | – | 4 |
| pear | 6 | 0 | – | – | – |
| Shiba | 6 | 0 | – | – | – |
| AuditTeam | 5 | 0 | – | – | – |
| aurora | 5 | 0 | – | – | – |
| Barracuda | 5 | 0 | – | – | – |
| Deadlock | 5 | 0 | – | – | – |
| Global Secret Group | 5 | 0 | – | – | – |
| Panzer | 5 | 0 | – | – | – |
Gangs with at least 5 claims followed. A share is shown only over claims old enough to have had a chance (30 days).
Early warning: when notices would be due
For gangs whose earlier claims were followed by an official breach notice at least 5 times (since 2020, matched by name), the median days that took. Applied to the claims still unconfirmed, it says when letters would be due if those claims are true. 96 open claims are due in the next 30 days. The organisations are not named here; each claim is on the map, faint, with its own date.
| Gang | Past claims followed by a notice | Median days to the notice | Open claims | Due in the next 30 days |
|---|---|---|---|---|
| The Gentlemen | 12 | 33 | 96 | 96 |
| INC Ransom | 24 | 71 | 63 | – |
| Qilin | 39 | 128 | 46 | – |
| Akira | 75 | 100 | 28 | – |
| Silentransomgroup | 9 | 49 | 24 | – |
| SafePay | 5 | 171 | 20 | – |
| Interlock | 14 | 134 | 13 | – |
| Rhysida | 17 | 121 | 13 | – |
| Genesis | 5 | 122 | 12 | – |
| Play | 39 | 116 | 11 | – |
| Pear | 15 | 98 | 6 | – |
| Anubis | 6 | 63 | 3 | – |
| Everest | 8 | 182 | 1 | – |
| Payoutsking | 11 | 104 | 1 | – |
| Chaos | 11 | 70 | 1 | – |
| DragonForce | 13 | 76 | 1 | – |
Claims that were backed up
How the ledger works
Ransomware gangs post the names of organisations they say they attacked on their leak sites. The tracker reads those claims daily from ransomware.live and keeps each one as a claim: faint on the map, never presented as a fact. When a news report or an official notice about the same organisation arrives, it is joined to the claim, and the record’s change log notes the day and the source. This page counts those changes.
A claim counts as confirmed when the organisation or an authority (a regulator, a state register, an SEC filing) confirms a breach, and as reported when the news reports one. Claims about a breach that was already public before the gang named it are not counted. Organisations whose claims are still unconfirmed are not named here: a claim is the attackers’ word, and some are false or exaggerated. Matching is by name, so a claim about a subsidiary or a renamed company can be missed, which makes these figures a floor.
Earlier claims, before the tracker kept them, are counted on each gang’s page, where claims are matched by name to official registers since 2020.
From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.