Ransomware Intelligence

Live Ransomware Attack Intelligence Dashboard

Real-time worldwide threat monitoring

Total Victims

11,192

+9.9%

confirmed ransomware victims

Active Ransomware Groups

204

+17.9%

tracked ransomware operators

Countries Affected

143

+0%

nations with reported attacks

Live Threat Intelligence

Last 7 days228 victims · 46 countries

Live Attack Feed

Real-time
2 Critical
NEW
CLAIMED
MEDIUM
in about 1 hour
NEW
CLAIMED
MEDIUM
in about 1 hour
NEW
CLAIMED
MEDIUM
in about 1 hour
NEW
CLAIMED
MEDIUM
about 1 hour ago
Roth Industriesroth-industries.com
Germany
qilin
Manufacturing
NEW
CLAIMED
MEDIUM
about 2 hours ago
Sparkle Poolssparklepoolsinc.com
United States
qilin
Retail & E-Commerce
NEW
CLAIMED
MEDIUM
about 4 hours ago
PJ Daly Contractingpjdalycontracting.com
Ireland
qilin
Other
NEW
CLAIMED
MEDIUM
about 4 hours ago
NEW
CLAIMED
MEDIUM
about 5 hours ago
Commune d'Eyguireseyguieres.org
France
qilin
Government & Defense
NEW
CLAIMED
MEDIUM
about 7 hours ago
NEW
CLAIMED
MEDIUM
about 7 hours ago
Klue.comklue.com
Canada
Icarus
Technology
NEW
DATA LEAKED
CRITICAL
about 11 hours ago
Hagerman & Companyaurora
Professional Services
NEW
CLAIMED
MEDIUM
about 8 hours ago
NEW
DATA LEAKED
CRITICAL
about 4 hours ago
ra-vogeler.dera-vogeler.de
Germany
cloak
Professional Services
CLAIMED
MEDIUM
about 23 hours ago
Homes By J Anthonyhomesbyjanthony.com
United States
qilin
Other
CLAIMED
MEDIUM
1 day ago
View all victims

Attack Statistics & Trends

Attack Volume — Last 12 Months

Jul 2025Sep 2025Nov 2025Jan 2026Mar 2026May 202603507001,0501,400

Top Threat Actors & Targets

SOCRadar Ransomware Intelligence is a free real-time threat monitoring platform that tracks active ransomware groups and their attack campaigns worldwide. The dashboard aggregates victim disclosures from ransomware leak sites, dark web forums, and SOCRadar's proprietary monitoring infrastructure to produce a continuously updated global attack map segmented by region, industry sector, country, and ransomware family. Security teams, threat hunters, and SOC analysts use it to understand which ransomware groups are active in their geography or sector, assess current threat levels before executive briefings, and generate domain-specific threat reports to check whether their organization has been mentioned in ransomware actor channels. Data refreshes every five seconds from live sources. No account required.