CanaryObservatory
 
Infrastructure & cyber · Instrument dossier

Ransomware Attacks

ransomware.live publishes incidents that ransomware groups themselves have disclosed. The observatory stores each claimed attack with its victim, the claiming group, the disclosure date and the victim's country. Claimed ransomware incidents are a confirmed, publicly documented class of cyber activity. A burst of claims in one country or sector is a real change in observed activity, not a guess about intent.

Current reading

100 publicly disclosed ransomware claims in the last 24 hours. Not enough data yet for a historical comparison.

Reading time:

Worldwide, wherever groups publish claims. The stored position is the centroid of the victim's country — approximate by construction. The attacker's location is never known from this source and is not inferred.

Collector availability
Live
Collection freshness
Last successful collection .

Historical comparison

Not enough data yet to draw a series in this range. History begins when collection begins.

Interpretation

Not enough data yet. The available history cannot establish whether this reading is typical or unusual.

What movement could mean
  • A claim burst concentrated in one country or sector
  • A sustained rise in daily claims across many countries

Not established. Claims follow the attackers' own publishing habits. A rise means more publicly disclosed ransomware activity, nothing more. Source-reported severity, statistical deviation and real-world risk are different questions. This reading does not independently support a hypothesis about intent or cause.

Evidence and limitations

Cadence and latency
Collection is scheduled every 30 minutes. Collection cadence is not source latency; no measured end-to-end latency is provided here. Source publication and revisions can delay what is visible.
Known false-positive patterns
  • A group posting backlogs of older victims at once
  • Duplicate listings across leak sites
  • A group going quiet, which looks like a fall in attacks
Coverage and blind spots
  • Only attacks that a group chooses to disclose appear — this is a floor, not a total.
  • The date is the disclosure date, which can lag the actual intrusion by days or weeks.
  • Locations are country centroids: they show where a victim is, not where an attack came from or which building was hit.
  • Attribution of the attacking group is the group's own claim and is unverified.
  • Victims with less media coverage are under-represented.
Technical detail
Measurement definition
Each observation is one claimed attack with value 1. The daily count baseline compares today's number of claims with the trailing weeks' daily pattern.
Raw metric
daily_count_attacks
Method
The collector reads the recent-attacks feed each run and upserts by group, victim and disclosure date, so an attack re-listed later does not duplicate. Country comes from the feed's own country code; unknown codes keep no position and are labelled unmapped.
Stored observations
100

Normal versus unusual

A baseline cannot yet be established. The observatory needs more history before it can say what "normal" looks like for this signal, so no anomaly score is shown.

0 historical samples so far · Trailing-24h count vs. mean/std of completed UTC days (std floored at √mean)

Source severity

The label the publishing agency assigns (e.g. NWS 'Severe'). Shown verbatim.

Statistical anomaly

How far today's value sits from this signal's own history. Says nothing about consequences.

Real-world risk

A judgment the observatory does not make. Consult official sources for safety decisions.

Observations in range

Recent collection runs

  • · success · 100 stored
  • · success · 100 stored
  • · success · 100 stored
  • · success · 100 stored
  • · success · 100 stored
  • · success · 100 stored
  • · success · 100 stored

How this works

We read ransomware.live's list of attacks recently claimed by ransomware groups on their own leak sites. Each claim is stored once by group, victim and date.

The number we watch is claims in the last 24 hours. "Normal" is the same weekday in earlier weeks (at least 21 days of history), because groups post on uneven weekly rhythms.

Limits: only attacks a group chooses to publish appear, often weeks after the fact, so this is a floor, not a total. Map rings are the middle of the victim's country, never the attacker's location.

FAQ

Does a spike mean a wave of attacks today?
Often it means one group published a batch of old claims at once.
Where are the attackers?
This data doesn't say. The separate Attack sources map layer shows where scanning machines' networks are registered, which is also not the same as who is behind them.