Every ransomware victim, the day they are named.
We track leak-site disclosures across active ransomware operators and a few hundred international sources, resolve each victim to a sector and a country, and mark what is claimed against what is corroborated. Delivered as a weekly briefing, a structured registry, and a lead sheet for the firms who defend them.
Claims marked as claims
A leak-site post is an accusation made by a criminal against a named company. Every record we publish carries its verification status and its corroboration count, so you can see what is asserted and what is confirmed. Most feeds print the accusation as an event.
Sourced outside the US
German, Spanish, Gulf and Indian outlets sit in the corpus alongside the English-language wires, in the languages they publish in. Where the framing of an incident diverges between them, that divergence is measurable rather than assumed.
Built for pipeline
Sector, country and urgency on every record, delivered as CSV, API or webhook. It arrives in a form your CRM can read, not as a PDF somebody has to retype.
- ·Weekly briefing
- ·Sector and country tags
- ·Information warfare section
- ·Everything in Reader
- ·Victim registry
- ·Actor timelines
- ·CSV export
- ·Everything in Analyst
- ·API access
- ·Exposure lists
- ·Watchlists and webhooks
- ·Everything in Vendor
- ·Fresh victim leads
- ·Sector peer and repeat victims
- ·Sector exclusivity available
We publish the fact of a public claim, with its source and its verification status. We never publish or supply breach contents, stolen data, or leaked credentials.