How this hub is built

What this is

A reference for people who have to defend organisations against ransomware and do not have a threat-intelligence team: which groups are active, which sectors and countries they are claiming, which vulnerabilities ransomware operators are known to exploit, and soon, which samples our product has been tested against. Built by SecuritySnares, a ransomware-prevention vendor. We sell through partners and we say so where it matters.

Claims, not confirmed incidents

Leak sites are run by criminals. A listing means a group claimed an organisation, on the day we first saw the post. It does not mean the organisation was breached, that data was taken, or that anything was encrypted. Groups overstate, recycle old breaches, and sometimes list the wrong company. We count claims because they are the only near-real-time public signal of who is being targeted, and we label them as claims everywhere.

The victim-naming rule

• Leak-site claims are shown only as aggregates: counts by group, sector, country and week. We store the listed name so we can de-duplicate, and we never publish it.
• Self-reported incidents may be named. When an organisation discloses an incident itself, in an SEC filing, a municipal bond notice, a federal or state breach-notification register, or a press release, we may name and link it, labelled "self-reported". The organisation chose to make it public; we are pointing to their own words.
• We never name an organisation on the strength of a leak-site post alone, and we never publish the contents of leaked data.

Data sources

More sources are added as they are wired in, each with its licence and attribution listed here: self-reported disclosures (SEC filings, HHS and state breach registers), government advisories and enforcement actions, and technique and tooling references. We do not republish any source's raw data, and we do not scrape sites whose terms forbid it.

Sector classification

Leak-site feeds rarely say what an organisation does. We assign a sector from the public listing with an automated, language-model-assisted classifier using this fixed list:

• Manufacturing. Discrete and process manufacturers, automotive and industrial suppliers, food and beverage producers.
• Critical infrastructure. Energy, utilities, water and wastewater, oil and gas, pipelines, telecoms and other essential services.
• Healthcare. Hospitals, clinics, health systems, payers and medical device makers.
• K-12 education. School districts, charter networks and K-12 service providers.
• Higher education. Colleges, universities and research institutions.
• Government. Federal, state, county and municipal agencies and public bodies.
• Financial services. Banks, credit unions, insurers, brokerages and fintech.
• Technology. Software, IT services, managed service providers and hardware vendors.
• Retail. Retailers, e-commerce and consumer brands.
• Transportation and logistics. Carriers, freight, shipping, warehousing and transit operators.
• Construction. General contractors, engineering firms and building trades.
• Professional services. Law, accounting, consulting, staffing and other business services.
• Hospitality. Hotels, restaurants, travel and leisure.
• Media and entertainment. Publishers, broadcasters, studios and gaming.
• Nonprofit. Charities, associations, foundations and religious organisations.
• Other. Organisations that do not fit another category.

Every classification records the classifier version and a confidence score. Claims that have not been classified yet are shown as "Unclassified" and the share is stated on each sector page. If a classification looks wrong, use the dispute path below; corrections are applied to the record, not just the page.

Countries and regions

Country is the organisation's headquarters country as given or inferred from the listing, ISO 3166-1 alpha-2. For US organisations we also record the state where it can be determined. Counts by country are claims, with the same caveats as above.

Update cadence

Sources are pulled once a night. Each page shows when a source last updated successfully. If a source fails, its last good data stays up and the timestamp shows the age; nothing is silently backfilled. Pages are cached for ten minutes.

Weekly brief

The brief is drafted by a language model from the data on this site, then read and edited by a person before it is sent. It states its sources and links back to the pages the numbers came from. Product statements in the brief are limited to claims we can substantiate; we keep a ledger of approved wording and the brief does not go beyond it.

How samples will be tested

You can submit a Windows executable and see whether RansomSnare stopped it. The test runs on disposable virtual machines with no network path to the internet or to us, with a production build of the agent and no special configuration. The sample is kept; the machine is destroyed.

Two runs

1. Qualification run, no agent. The sample is detonated on an unprotected machine holding a corpus of ordinary files with known contents. It qualifies as ransomware only if it rewrote those files with encrypted-looking content, over a minimum count. Partly encrypted files and ciphertext written out as base64 or hex count. A renamed extension or a ransom note is supporting evidence, not a requirement. If it does not encrypt, we stop and report that we could not make it encrypt files. We do not say "benign", and we do not run the protection test.
2. Protection run, agent installed. Only qualifying samples get this run, on an identical machine with RansomSnare installed.

Thresholds (method version 2026-10-06)

• Qualifies as ransomware: in the unprotected run, 20 or more canary files were rewritten with high-entropy content and their file signatures destroyed.
• RansomSnare stopped it: the protected run recorded an agent block event and 10 or fewer canary files were touched before the block.
• RansomSnare did not stop it: the protected run encrypted 20 or more canary files, or a block came only after more than 10 files were touched.
• Result unclear: anything in between, for example a protected run that neither encrypted files nor recorded a block. Re-queued once, then reported as unclear.
• Time box: 10 minutes of wall clock per run with simulated user activity; the machine is destroyed afterwards whatever happened.

Verdicts

Verdicts cover encryption only. Data exfiltration is not tested and no result claims otherwise. Every result shows the RansomSnare version it was tested against and when; we also record the machine image and method version behind it. Re-testing samples after agent upgrades is planned but not yet automatic; a result stands for the versions it names. Any change to the thresholds or steps above gets a new method version and a dated entry in the changelog below.

Dispute or correct something

If a classification is wrong, a group should be merged with another, a source is mis-credited, or you think our test method is unfair to a sample, email info@securitysnares.com with the page URL and, for a sample, its SHA-256. If you would rather use a form, the contact form works too; start the message with "Ransomware hub:" so it reaches the right person. We answer every one, and corrections are noted in the changelog.

Changelog

• 2026-10-14: Test corpus enlarged to 500 ordinary files of 1 to 8 MB each. Encryption detection now also recognises files that were only partly encrypted and ciphertext written out as base64 or hex. Thresholds unchanged.
• 2026-10-08: Detonation thresholds published (method version 2026-10-06): qualification at 20 or more encrypted canary files; "stopped it" requires a block event and 10 or fewer files touched. Re-testing on agent upgrades is planned, not yet automatic.
• 2026-10-08: Published. Sources: RansomLook and CISA KEV. Group, sector and subscribe pages added.