# Ransomware Victims Tracker: Who Got Hit, By Which Group (`scrapemint/ransomware-victims-tracker`) Actor

Organisations named on ransomware leak sites, with the group claiming each one, the country, the sector and when the claim appeared. Every row is labelled as an attacker claim rather than a confirmed breach. Keyless, no account.

- **URL**: https://apify.com/scrapemint/ransomware-victims-tracker.md
- **Developed by:** [Ken M](https://apify.com/scrapemint) (community)
- **Categories:** News, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$4.00 / 1,000 claim rows

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Ransomware Victims Tracker: Who Got Hit, By Which Group

Ransomware groups publish the organisations they say they have breached on their own leak sites, to pressure them into paying. This turns those postings into clean rows: **the named organisation, the group claiming it, the country, the sector, and when the claim appeared.**

No API key, no account, no browser.

### Read this before you use the data

**Every entry is a claim made by a criminal group on its own leak site. It is not a confirmed breach.**

Claims are sometimes exaggerated, sometimes recycled from older incidents, and sometimes simply false — a listed organisation may never have been compromised at all. Every row carries `recordType: "attacker claim"`, `isConfirmedBreach: false` and a caveat naming the source. **Do not publish these as verified breaches**, and treat any individual entry as a lead to verify rather than a fact.

The source also masks some organisation names itself. Those rows are flagged `victimNameMasked` so asterisks read as deliberate redaction rather than a parsing fault.

### Modes

- **Victims** - one row per claimed victim, filterable by country, sector, group, calendar month and how far back to look.
- **Groups** - one row per ransomware group: aliases, when it was first seen, how many leak sites it runs and how many are currently online, tooling and techniques counted.
- **Summary** - claim counts by group, country or sector over the window, with each one's share, so you can see who is currently most active.

### Example output

```json
{
  "mode": "victims",
  "victimName": "Bretford Manufacturing",
  "groupName": "aurora",
  "country": "US",
  "sector": "Manufacturing",
  "claimedAt": "2026-07-29T09:14:22.000Z",
  "discoveredAt": "2026-07-29T09:31:05.000Z",
  "leakSiteUrl": "http://...onion/post/...",
  "recordType": "attacker claim",
  "isConfirmedBreach": false,
  "victimNameMasked": false
}
```

### Things worth knowing

- **The same record arrives under different field names depending on the filter you use.** The recent feed calls them `victim`, `group` and `attackdate`; the country and sector feeds call the very same things `post_title`, `group_name` and `published`. A parser written against either shape returns nulls for the other, so everything is normalised to one set of names here.
- **"Not Found" is a placeholder, not a sector.** The source writes that string where it has no value; it becomes null rather than a sector called Not Found.
- **Two dates, and they mean different things.** `claimedAt` is when the group posted the claim, `discoveredAt` is when the aggregator noticed the post. Records the source publishes without any date are kept rather than silently dropped by the date filter.
- **The service rate limits.** A burst of requests returns 429, so requests are spaced and backed off. Runs are deliberately unhurried.
- **Country and sector selections can be large** — one country returned six megabytes — so use the row cap.
- Sector names have to match the source's own spelling, for example "Financial Services" and "Retail & E-Commerce".

### Who this is for

- **Threat intelligence teams** tracking which groups are active this week and against which sectors.
- **Cyber insurers and brokers** watching claim frequency by country and industry.
- **Security vendors and consultancies**, for whom an organisation named this week is a live, motivated prospect.
- **Journalists and researchers**, provided the claim framing above is respected.

### Pricing

**$0.004 per row.** The first 2 rows of every run are free, and note rows (a filter nothing matched, a selection with no data, a source error) are never charged.

The default run of 100 recent claims is **$0.40**. A monthly summary by group is usually under 40 rows. A single country over a month is typically a few dozen rows.

### Related actors

- **CVE Vulnerability Tracker** - the vulnerabilities behind many of these intrusions.
- **Dependency Vulnerability Scanner** - what is exploitable in your own code.

### How to run it via API

```bash
curl -X POST "https://api.apify.com/v2/acts/scrapemint~ransomware-victims-tracker/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"summary","summariseBy":"sector","daysBack":30}'
```

Data aggregated by ransomware.live from public leak sites.

# Actor input Schema

## `mode` (type: `string`):

victims = one row per claimed victim. groups = profiles of the ransomware groups themselves. summary = claim counts by group, country or sector so you can see who is most active.

## `country` (type: `string`):

Two letter country code such as US, GB, DE. Leave empty for all countries.

## `sector` (type: `string`):

Sector name as the source spells it, for example Healthcare, Manufacturing, Technology, Financial Services. Leave empty for all sectors.

## `group` (type: `string`):

Filter to one group by name, for example lockbit or safepay. Partial names match.

## `year` (type: `integer`):

With month, pulls the claims posted in that calendar month instead of the most recent ones.

## `month` (type: `integer`):

1 to 12. Used together with year.

## `daysBack` (type: `integer`):

How recent a claim has to be to be returned. Records the source publishes without a date are kept rather than silently dropped.

## `summariseBy` (type: `string`):

Summary mode only.

## `maxRows` (type: `integer`):

Cap on rows returned. Controls total cost.

## Actor input object example

```json
{
  "mode": "victims",
  "country": "",
  "sector": "",
  "group": "",
  "year": 0,
  "month": 0,
  "daysBack": 30,
  "summariseBy": "group",
  "maxRows": 100
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "daysBack": 30,
    "maxRows": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapemint/ransomware-victims-tracker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "daysBack": 30,
    "maxRows": 100,
}

# Run the Actor and wait for it to finish
run = client.actor("scrapemint/ransomware-victims-tracker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "daysBack": 30,
  "maxRows": 100
}' |
apify call scrapemint/ransomware-victims-tracker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapemint/ransomware-victims-tracker"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/aqHQMf1I1wHNbLo8s/builds/jQarexYJzdrIFBsDm/openapi.json