Ransomware victim search

What this tool does

This is a historical search across our locally-stored archive of ransomware leak-site posts. Every public claim posted to a known ransomware group's leak site since 2026-04-25 is captured and kept indefinitely. Where ransomware.live runs a sliding window and lets older posts roll off the live feed, our copy is permanent. Search by company name, brand, or domain fragment and you'll see every post we have on record, even if the original group's site has since gone down or rotated to new infrastructure.

The tool is free and requires no signup. We track over 333 ransomware groups, with 100+ recent victims at any given moment plus a long tail of older posts. Search supports fragments: acme matches Acme Corp, acme.com, and Acme Industries Ltd. For common words, switch to a domain fragment to cut noise.

How to read a result

A result means a ransomware group POSTED a victim claim mentioning the name you searched. That is the precise scope, and the distinction matters. Leak-site posts are the group's marketing surface. They are claims, not always confirmed breaches. Some victims publicly deny the claim. Some dispute the data sample. Some pay the ransom before the data is published and the post is quietly removed. Treat any hit as a strong lead worth investigating, not as a verdict.

Each result links to two follow-on pages. The per-victim page shows the group's claim, the sector and country we have on record, the posting date, and any data samples the group made public. The per-group profile shows the active leak-site URL where reachable, the full victim history we've captured, sector and country concentration, and posting cadence.

What to do if your company is listed

If you find your organization in the results, move carefully and follow your incident response process. The list below is general guidance, not legal or contractual advice.

• Confirm the post on the group's actual leak site. We link directly. The post may have additional context, data samples, or claimed deadlines that didn't surface in our structured capture.
• Check whether the post mentions data samples, payment deadlines, or contact details. Those details inform how much time you have and what data is allegedly affected.
• Notify your incident response team and legal counsel before any other action. Many incidents trigger regulatory clocks (GDPR, state breach laws, sector regulators) and counsel needs to be in the loop early.
• Don't engage with the group directly through the leak site. If you have cyber insurance, your policy almost certainly requires carrier notification before any negotiation.
• Report the incident. In the U.S., file with CISA at cisa.gov/forms/report and the FBI's Internet Crime Complaint Center at ic3.gov. Outside the U.S., contact your national CERT.
• Consider engaging a ransomware recovery specialist if you don't already have one on retainer. A specialist firm coordinates forensics, negotiation (where permissible), and recovery. Your insurance carrier may have preferred panel firms.

Frequently asked questions