How many EU organisations are being hit by ransomware right now?

The tracker shows a live count of EU organisations claimed on ransomware leak sites in the latest snapshot, broken down by country, ransomware group and industry. Leak-site claims undercount real incidents, so treat it as a floor.

Where does the ransomware data come from?

From public ransomware leak-site monitoring, aggregated into counts. We show counts only and cite the snapshot — no victim details are republished.

Live EU Ransomware Tracker — Claims by Country, Group & Industry

EU ransomware tracker

Loading this quarter…

Ransomware groups publicly claim their victims on leak sites. This is the EU-27 subset for the current quarter — who's being hit, by whom, and in which industry. The point isn't the names; it's that being small or out of NIS2 scope doesn't decide who gets targeted.

Aggregated from public ransomware leak-site claims for the current calendar quarter. “Other” = the source couldn't classify the victim's sector. Claims can be double-posted or exaggerated, and no victim names are shown.

Targeted or not, what would a breach cost you?

Turn this threat picture into your own number — run the free CRQ simulation for a projected Expected Annual Loss in euros.

Run Free Financial Scan Book a Demo