Ransomware leak site check
Claims naming the organisation on ransomware leak sites, from two independent trackers.
Last reviewed
Weight in the score
20%
One of six modules, scoring policy v2.1.0
Sources
- ransomware.live
- RansomLook
Ransomware groups publish the names of organisations they claim to have attacked. Two independent trackers collect those claims, and we check both for your domain and organisation.
A claim from the last twelve months is scored as critical, because it may mean an incident is still unfolding. An older claim is still reported, at a lower severity. When both trackers list the same claim it is reported with full confidence, and the same post seen twice is counted once.
Matching is deliberately conservative. An organisation name is matched against the victim name or the title of a post, never its free text, because leak-site posts often mention other companies. A victim listed under a trading name we do not know may be missed.
Findings this module can raise
Every finding in a report says what was tested, why it matters, the impact and how to fix it. These are the findings this module can raise, most serious first. Terms are explained in the glossary.
Criticalseverity 90 to 100
95
Active ransomware claim: domain listed on leak site
Ransomware groups publish victims on leak sites to pressure payment. A listing is a public claim by the attackers that they compromised the organisation and hold its data.
How to fix it: If this is new to you, treat it as an active incident and start your response plan now. If it is a known past incident, confirm the initial access route was closed rather than just the ransomware removed, force a credential reset across the estate, and check whether the leaked data creates continuing notification duties. Where two trackers agree, the claim is corroborated; a single-source claim matched only on organisation name is worth verifying against the leak site itself before acting.
What was tested and the impactHide details
- What was tested
- The organisation name and domain, searched against public ransomware leak-site trackers (ransomware.live and RansomLook)
- Impact
- A listing usually means data was already exfiltrated, so the exposure survives even a clean recovery from backups. Regulators, insurers and customers treat a leak-site appearance as a confirmed incident, and the same access path is often resold to other actors.
Highseverity 70 to 89
75
Historical ransomware claim
Ransomware groups publish victims on leak sites to pressure payment. A listing is a public claim by the attackers that they compromised the organisation and hold its data.
How to fix it: If this is new to you, treat it as an active incident and start your response plan now. If it is a known past incident, confirm the initial access route was closed rather than just the ransomware removed, force a credential reset across the estate, and check whether the leaked data creates continuing notification duties. Where two trackers agree, the claim is corroborated; a single-source claim matched only on organisation name is worth verifying against the leak site itself before acting.
What was tested and the impactHide details
- What was tested
- The organisation name and domain, searched against public ransomware leak-site trackers (ransomware.live and RansomLook)
- Impact
- A listing usually means data was already exfiltrated, so the exposure survives even a clean recovery from backups. Regulators, insurers and customers treat a leak-site appearance as a confirmed incident, and the same access path is often resold to other actors.