State of Ransomware — monthly reports

Auto-generated monthly retrospectives of provider-observed claims across tracked leak sites.

Each report covers headline metrics, group and provider rankings with month-over-month movement, new and emerging groups, sector and country breakdowns, and notable changes. Report-month observations are kept separate from broader historical context, and all claims remain unverified allegations.

How the monthly reports are generated

Each State of Ransomware report is generated automatically from the canonical dataset for one complete calendar month: headline metrics, group and provider rankings with month-over-month movement, newly emerging groups, and sector and country breakdowns. Report-month observations are kept separate from broader historical context so a month is never restated by later data.

Rankings move only on measured observation counts. Emerging groups are anchored to provider discovery evidence — first observations from feeds that can actually establish first-seen, excluding snapshots, mirrors, and claim-date-only sources.

Example: reading this page correctly

Example reading: a group rising five ranking places month-over-month means providers observed proportionally more claims from it than from its peers that month. Citing the movement requires the month and the observed-claims basis; it does not support conclusions about revenue, size, or capability.

Frequently asked questions

When is a month's report available?

After the month completes — reports cover complete months only, consistent with the tracker's complete-buckets rule, so partial-month numbers are never published and later revised.

Are these reports written by AI?

The metrics, rankings, and breakdowns are computed deterministically from provider observations. No generated prose adds claims that the underlying data does not contain.

Can I cite a monthly report?

Yes — each report describes a fixed, named month of provider-observed claims, which makes it a stable citation target. Keep the unverified-allegation caveat and the observed-claims basis in the citation.

Data freshness

A new report is generated after each calendar month completes. Within the month, the live pages — the overview, weekly signals, and the calendar — carry the current state; the monthly report then freezes that month's numbers for citation.

Related pages

• Weekly signals between monthly reports
• Daily publishing calendar across the year
• Current group directory and statuses
• Counting rules and exclusions behind the numbers

Explore the tracker

• Live ransomware tracker overview
• Ransomware group directory
• Victim-claim directory
• Ransomware activity by country and sector
• Weekly ransomware signals
• Monthly State of Ransomware reports
• Data quality and screening dashboard
• Methodology and evidence model
• Glossary of tracker terms

Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.