Ransomware Activity

Click any row to filter the table below — countries and sectors can be combined, and clicking a selected row again removes it. Each panel counts as if its own filter were not set, so switching from one country to another works without resetting. The pooled “other” row is not selectable: it is an artefact of the top-12 cut-off, not a value in the data.

ransomware.live does not attribute a country to every disclosure — in recent samples roughly half of all records carry no country code, and a large share of sectors are filed as “Other”. Both are shown as their own selectable row rather than left out, so the proportions stay honest. Figures reflect victims published on leak sites, not confirmed incidents.