Skip to main content
Search ransomware leak-site victims to see which organizations ransomware groups have named and published. Use it to confirm whether a company, a supplier, or a peer in your sector has been posted on a group’s data-leak blog, and which group claimed the attack. This is a synchronous lookup. One GET to ransomware_victims_list returns matching victims in the same response. Search by company name or by domain.
Search by domain instead, and narrow to a window with start_date / end_date:
Results are paginated: pass take (page size, max 100) and skip (offset), and walk the offset forward against the count in the response.

​
Request parameters

Rate limit: 10,000 requests per day. This source costs 0 credits per call.

​
What comes back

The response is an object with a total count and a rows array, where each row is one ransomware-leak victim record.
  • count — total number of victims matching your query, across all pages.
  • rows — the page of victim records. Each record carries:
    • id — the victim record identifier.
    • company — the named organization.
    • domain — the victim’s domain, when the group published one.
    • groupname — the ransomware group that claimed the victim.
    • country — the victim’s country.
    • region — the victim’s region.
    • industry_type — the victim’s industry.
    • description — the group’s posted description of the victim or the leak.
    • discovered — when the victim was first seen on the leak site.
    • created_at — when the record was first stored.
    • updated_at — when the record was last updated.
A hit here means the organization has already been named on a group’s leak site, so treat it as a confirmed compromise, not a warning. Use groupname and discovered to attribute and time the incident, and run the same search on your key suppliers and partners to catch third-party exposure that lands in your supply chain.