Ransomware Claims Against Australian Organisations

Ransomware groups have posted 526 Australian organisations on their leak sites since 1 June 2016, by 107 different groups. 167 of them were posted in the last twelve months, 12% more than the 149 in the twelve before. The typical month brings 14.5 claims, and the busiest in the last two years was November 2024 with 20.

Every row on this page is a claim made by a criminal group on its own site, recorded by the public tracker ransomware.live. Nothing here is verified. Groups list organisations they never breached, list them during negotiations, and get names and countries wrong. Where we have written a brief on a listing it says "claims" for that reason, and so does this page.

Claims per month

Who is posting now

21 groups posted an Australian organisation in the last 90 days, 44 claims between them against 51 in the 90 days before. 11 of them had not posted an Australian victim in the quarter before that. The most active this quarter is thegentlemen with 9 claims. This is the present tense, not a forecast: which group posts next depends on whose affiliates compromised whom months ago, and the sequence of Australian posts does not predict it.

Over the whole file, 41 groups have posted exactly one Australian organisation and never returned. The groups that keep coming back are few:

Sectors, last twelve months

Of the 167 organisations posted in the last twelve months, the tracker could place 158 in a sector and 9 it could not. Professional Services leads with 22.8% of the classified claims. For an Australian business the question this answers is not "am I a target", which every sector is, but how often organisations like yours have been posted lately.

• Professional Services 36 · 22.8%
• Retail & E-Commerce 29 · 18.4%
• Healthcare 17 · 10.8%
• Technology 17 · 10.8%
• Manufacturing 16 · 10.1%
• Agriculture and Food Production 8 · 5.1%

The latest claims

The 15 most recent, newest first. Briefs are written for new listings as they arrive.

What this page can and cannot say

• Claims, not breaches. A listing means a group said it has an organisation's data. Some listings are true, some are exaggerated, some are false, and this page cannot tell which. It reports what was posted.
• The country is inferred. The tracker tags a victim's country from its website and public records, and gets it wrong sometimes; a Canadian law firm has sat in the Australian file. The counts here carry that error.
• Dates are when the tracker saw the post. A group may have posted days earlier, and the incident itself is usually weeks or months before that.
• Groups rename and reorganise. A group that "disappears" from the table has often reappeared under another name, and a "new" group may be an old one's affiliates. The tables use the names the tracker uses.
• No forecast. Which group posts the next Australian victim is not predictable from this data, and the page does not try. A rate is a fact; a prediction would be a guess with a decimal point.

Method

The source is ransomware.live's public API, its file of every victim tagged Australian, which our news worker reads every three hours for its own leak-site feed and caches. This page reads that cache and computes every figure above at request time, so the numbers and the sentences describing them can never disagree. Months are counted by the tracker's discovery date. A sector the tracker could not determine is counted but never ranked. The page is cached for fifteen minutes.