// CONFIRMED RANSOMWARE ATTACKS · INDEX

Ransomnews has independently confirmed 9,520 ransomware attacks across 150 countries between January 2018 and August 2026. Every incident was verified against a public source such as a breach notification, regulatory filing, court record or press report; leak-site claims alone do not count. The pages below cut that record by sector, by country and by year, with the most active groups, the largest incidents by records exposed, ransom payment outcomes and the most recent confirmed cases for each.

9,520Confirmed incidents

150Countries

13Sector pages

14%Paid, where outcome is public

Ransomware attacks by sector

Ransomware attacks by country

Countries with at least 25 confirmed incidents. The United States dominates any confirmed dataset because its breach-notification and SEC disclosure rules push more incidents onto the public record than other jurisdictions.

Ransomware attacks by year

Ransomware attacks by month

The latest 13 months. Recent months are provisional and keep filling in as disclosures arrive; every earlier month is linked from its year page.

Related analysis

Method. An incident enters the dataset only when confirmed by at least one independent public source. Each record carries the attack month, the victim organisation, city and country, industry classification, the ransomware strain where attribution is solid, and records exposed and ransom outcome where a source disclosed them. Coverage runs from January 2018 to the present and the database refreshes weekly. Cite as: Ransomnews Confirmed Ransomware Attacks Dataset, ransomnews.com. Bulk access and methodology questions: [email protected].