In the last 24 hours, 49 organisations were named on ransomware leak sites, against 22 yesterday and a seven-day average of 39.0. The count is what operators publish; victims who pay before being listed, or who are hit by groups without a leak site, never appear.

Qilin posted the most listings in the last 24 hours (9). Over the last 30 days the most active operator is The Gentlemen with 100.

No. A listing means an operator claims to have breached the organisation and is pressuring it to pay. Some claims are inflated, duplicated across rebrands or fabricated. Ransomnews keeps a separate, human-verified confirmed ransomware attacks dataset corroborated against notifications, filings and press reports.

The collector parses leak sites continuously and the figures on this page recalculate every 15 minutes; the time stamp at the top says when. The live tracker carries the same data with search, 24 months of trends and a country map, and each year has its own archive page.

Yes: search the organisation name on the tracker, or filter the index by year and operator. Masked names (for example "Company #69") are shown exactly as the operator posted them.