Overview
Industries hit
View all →Organizations breached or claimed, by industry, most confirmed first. Arrows show the change against the previous period (▲ more, ▼ fewer); conf. = confirmed or public report, unconf. = unconfirmed claim; accent edge = high-impact industry.
Breaches around the world
View all →Breached organizations by country. Dots mark countries with breached companies, sized by count; pulsing dots have new breaches in the last 24 hours. The card cycles through the latest breaches. Hover a country for its count; click it to see the organizations.
Most affected countries
All countries →Confirmed & public breaches
By parent company →View all →Breaches confirmed by the organization or a regulator filing, or reported publicly (news, Have I Been Pwned), newest first. Click one for details.
Top attackers
Ransomware groups ranked by the organizations they hit or claimed. Confirmed means the breach was confirmed by the organization, a regulator or the news; unconfirmed means only the group's own claim. The trend compares with the previous period of the same length. Click a group for its victims and methods.
Trends · last 12 weeks
Organizations per week for the five most active groups; the arrow compares the last 4 weeks with the 4 before. Typical attack: how the group gets in and what it does, from news about its victims (number in brackets), CISA #StopRansomware advisories and MITRE ATT&CK. ■ confirmed ■ unconfirmed
One attack, many victims
View all →Attacks linked to several confirmed or publicly reported breaches: the same vulnerability named in reporting about each breach, or several organizations named in the same news story. Click one for the organizations.
Unconfirmed ransomware claims
View all →Organizations posted by ransomware groups on their leak sites, with no confirmation from the organization, a regulator or the news. Treat as claims, not facts. Names are withheld for the first 24 hours and hidden unless you choose "Show unconfirmed names".
Vulnerabilities
Zero-days, the vendors attackers target most, flaws being exploited right now and flaws behind real breaches, listed by vendor and product.
Top zero-days & critical vulnerabilities
View all →Zero-days first (exploited before a fix existed, or still unpatched), sourced from Google Project Zero, vendor advisories and Zero Day Initiative; then critical flaws (CVSS 9.0+). Listed by vendor and product.
Top 5 vendors attacked
Vendors whose products were most exploited in attacks in the last 30 days, with their two-year record: flaws exploited (CISA KEV) and breaches of the company itself. Click one for details.
Top 5 vendors breached
2 yearsView all →Technology and IT-service companies that were breached themselves: a supply-chain risk for their customers. Ranked by incidents in the past 2 years.
Vulnerabilities used in successful attacks
View all →Flaws behind real attacks: named in reporting about a breached organization, flagged by CISA as used in ransomware campaigns, or reported exploited in attacks. Listed by vendor.
Actively exploited vulnerabilities
View all →Flaws attackers are using now, by vendor. Exploitation reported by CISA KEV, VulnCheck KEV, vendor advisories, ENISA EUVD or CIRCL sightings. Bar = exploit likelihood (FIRST EPSS); "Public exploit" = attack code is published (Exploit-DB, Metasploit, Nuclei).
Known vulnerabilities behind breaches
Flaws tied to real attacks: named in news reporting about a specific breached organization, or flagged by CISA as used in ransomware campaigns. Click an organization to see its entry.
| Vulnerability | Product | Breaches tied to it | Evidence | Exploit likelihood |
|---|
Ask your IT provider to check these
Attackers are actively using these flaws right now, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Each affects technology commonly found in small and mid-sized businesses. You don't need the technical details; just ask whether you use it and whether the fix is in place.
Organizations hit
Every organization breached or claimed in the selected period, by industry, and the trend over the past 12 months.
All organizations hit, by industry
Ransomware groups post victims on extortion sites to pressure them into paying. Every entry carries one label: Company confirmed the organization filed with a regulator or said so itself; Public report covered by news outlets or listed by Have I Been Pwned, not confirmed by the company; Unconfirmed attacker claim only, treat with caution.
Breaches in the news
Recent reporting from security news outlets · last 7 days