Say what the data does not cover, on the page that sells it.
Every competitor in this space presents a feed as though it were a record of what happened. We cannot credibly claim that: the registry is weeks old, it comes from one aggregator, and every row is an unverified claim made by a criminal. So the coverage numbers sit on this page, next to the products they describe.
| Field | Records | Coverage | What we may say about it |
|---|---|---|---|
| Victim name, operator, date | not measured | not measured | Every record. This is the product. |
| Sector (inferred) | not measured | not measured | Inferred from the name. Never confirmed. |
| Domain present | not measured | not measured | Where the actor published one. |
| Registration country | not measured | not measured | Where the domain is registered, not where the business is. |
| Redacted by the actor | not measured | not measured | Partial names, flagged, never rendered as an organisation. |
| Duplicate suspects | not measured | not measured | Flagged, not removed. Concentrated inside single operators. |
The Weekly Brief
Available nowWhat the extortion sites published this week, read and written up. One lead story chosen from the data rather than from a news cycle, the operators that moved, and a method block that does not change between editions. Wednesday to Tuesday, out Thursday.
Coverage begins 9 August 2026. No year-on-year comparisons, because we do not have a year.
Victim Registry
Available nowEvery organisation named on a ransomware extortion site since 9 August, with the group that named it and the date it appeared. Duplicate suspects are flagged rather than quietly removed, and partial names the actor redacted are marked as partial.
Records are claims, not confirmed breaches.
Coverage per field is in the table above, and it is measured rather than claimed.
API and CSV Export
Built, not yet servingThe registry as a file or as JSON. Filter by operator, sector or date. Rate limits are published rather than discovered: 30 requests an hour and 100 a day on the research tier, higher on the machine tiers.
The endpoint exists and fails closed. It cannot serve a customer yet.
Actor Intelligence
ComingThe groups rather than the victims. Which crews are active, which have gone quiet, and which names are the same crew under a new brand.
The data exists. Nothing serves it yet.
Campaign Exposure
ComingWhich crews are working which sectors, right now. When one gang names eight healthcare organisations in a month, that is a campaign and the sector is the story. Counts by operator, inferred sector and registration country, over a stated window.
An indicator, not a list. It says which sector a crew is working. It cannot tell you who is next.
Lead Engine
ComingOrganisations named in the last 24 hours, filtered to your territory and sector, delivered as a sheet your team can work. Not threat intelligence. A list of companies that have just had the worst week of their year.
Not built.
Pricing is on its own page rather than on the cards, because the tiers are still moving. See the live corpus.