Ransomware.live reports dozens of victim disclosures in past 10 days

Ransomware.live is a platform that continuously monitors and scrapes ransomware groups' leak sites and lists newly published victim information. On the site’s "Last 10 days activity" page, it aggregates the number of disclosures per day along with the top attacking groups, affected countries, and industries; for example, October 31 shows 84 cases and November 4 shows 69 cases among the many recorded disclosures.

In the aggregates, the United States ranks near the top; as examples, October 31 is listed as "United States 23" and November 4 as "United States 24." Frequently occurring victim industries include manufacturing, Technology, and professional services, indicating that incidents are occurring across multiple sectors.

The site’s "Recent Victims" section lists individual entries that include discovery time, group name, company overview, and the estimated attack date. Examples of listed companies include Expedia Group (N0n), STARMARK and Grupo Telles (Lockbit5), Christie Digital Systems (Metaencryptor), and Maersk (Whitearmor). Each entry is based on publicly available sources, and may include accompanying information icons indicating the presence or absence of screenshots, leaked data, or media coverage.

Because the site’s data are produced by automated scraping and monitoring, the timing and content of listings are updated continuously. Therefore, individual victim details (such as the scale of leaks or ransom demands) depend on what is displayed at the time of posting and may be subject to verification or subsequent updates. Security teams can use these lists for initial situational awareness and threat assessment, but should corroborate entries with primary sources or official statements from the affected companies.