Ransomware victims: by the numbers
Every victim a ransomware group names on its leak site, aggregated by The Nexus. Counts reflect leak-site postings (claimed attacks), not confirmed breaches. Updated daily.
In the last 90 days, Business Services was the most-targeted sector (9% of victims with a known sector), and victims were concentrated in US.
The Nexus aggregates victims that ransomware and extortion groups publish on their dark-web leak sites. A “victim” is an organization a group has named; it reflects a claimed attack, not a verified breach, and groups sometimes re-post or exaggerate. Sector and country are classified per victim; some are unclassified and excluded from the sector and country lists. Counts are by leak-site posting date. The full, source-linked victim list and per-group profiles are on the live tracker.
The Nexus Ransomware Victims Tracker, https://thenexus.news/underground/report (accessed 2026-07-11).