Ransomware.Live
Public site tracking ransomware groups, leak-site claims and victims.
By 21 October, ransomware.live had recorded 680 leak-site claims for the month, a count of criminal posts rather than 680 independently confirmed breaches.
Last refreshed: 22 October 2026
Which leak-site claims will named organisations actually confirm?
Timeline for ransomware.live
Counted Qilin's October leak-site claims
Cybersecurity: Threats and Defences: SiteGuard hit; Qilin posts Keio filesCounted 680 October leak-site claims
Cybersecurity: Threats and Defences: N0n claims 38 firms, mostly maritimeMentioned in: Ransomware crews' claims fall to 815
Cybersecurity: Threats and DefencesMentioned in: Ransomware claims rose 11 per cent in August
Cybersecurity: Threats and DefencesMentioned in: Qilin's own affiliate now outposts it
Cybersecurity: Threats and DefencesBackground
ransomware.live is a public tracker that collects posts from ransomware and data-extortion groups' leak sites. Its website and public API organise names, discovery dates and group labels, allowing researchers to compare what criminal groups claim over time. Security researcher Julien Mousqueton maintains the project and publishes its monitoring code openly.
The site's records need careful interpretation. A listing shows that a criminal group posted a claim; it does not by itself prove unauthorised access, ransomware deployment, data theft or publication. In October 2026, for example, N0n published a large cluster of claims against maritime businesses, while the shared deadline and data shape suggested, but did not confirm, a common supplier.
The tracker is therefore a measure of leak-site activity. Confirmation still has to come from affected organisations, investigators or other evidence.
ransomware.live records claims before confirmation
The data-theft group N0n listed 38 companies on 12 October, mostly port and shipping operators across 18 countries and territories. Thirty-seven shared a 19 October deadline, while N0n led the month's leak-site count with 122 claims.
ransomware.live records such posts by group and discovery date. Its October API counted 680 claims through 21 October, including 122 attributed to N0n and 71 to Qilin. Those numbers measure criminal leak-site posts, not independently verified intrusions. That distinction matters when Qilin posts files from a named company, even if separate evidence later confirms an attack.
What is ransomware.live?
Does a ransomware.live listing prove a breach?
How many leak-site claims did ransomware.live count in October 2026?
How many October 2026 claims did ransomware.live attribute to Qilin?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.