How many ransomware victims will ransomware.live record as posted on leak sites between 1 January and 31 March 2027?

TL;DR

The median forecast is 3,380 victim listings January 1–March 31, 2027. The 10th percentile is 2,435 victim listings January 1–March 31, 2027, and the 90th percentile is 4,730 victim listings January 1–March 31, 2027. Use the median as the central expectation and the broad interval to account for campaign shocks, changes in criminal publishing, and monitoring coverage.

Context

As of November 5, 2026, ransomware.live observations show an elevated level of public victim claims. The question concerns the next first quarter, not attacks already observed. The target is the number of distinct records discovered from January 1 through March 31, 2027, in UTC, present in the specified April 15, 2027 database snapshot.

This is a measure of public listings, not unique organizations or independently verified breaches. Separate entries for the same organization count separately when they remain distinct records. Discovery date controls inclusion; attack date and leak-publication date do not. The resolution source is ransomware.live, with complete record-level counts taking precedence over inconsistent summaries under the question's rules.

Evidence

The historical backbone is the observation-date record series available on the forecast date. It covers 46 complete months from January 2023 through October 2026. The quarterly history shows both a rising level and large reversals. Growth has not followed a smooth path.

Year	Q1 records	Q2 records	Q3 records	Q4 records
2023	805	1,272	1,822	1,430
2024	1,110	1,749	1,326	1,926
2025	2,386	1,666	1,744	2,507
2026	2,361	2,363	3,042	Incomplete

This history supports two conclusions. First, recent activity is high relative to earlier years. Second, a high quarter does not establish a lasting growth rate. Q1 2026 was slightly below Q1 2025. Q3 2024 was below Q2 2024. The forecast therefore recognizes the higher recent level without treating uninterrupted growth as a fact.

The latest complete monthly observations provide a closer view of that level:

Month	Observation-date records
July 2026	952
August 2026	1,209
September 2026	881
October 2026	1,168

Together, these months contain 4,210 records over 123 days. The corresponding July–October 2025 total was 2,612. That is strong evidence of a higher recent pace. It is also a reminder to distinguish a broad increase from a straight-line trend: September fell after August, and October rose again. The partial November 1–4 observation contained 154 records, but four days do not establish a quarterly direction.

The saved median reflects continued elevated activity with some further growth. The wide interval reflects the historical variability around that direction. There is no clear basis for treating Q1 as reliably stronger or weaker than the preceding quarter. The available year transitions are too few and too affected by campaigns to establish a stable seasonal rule.

Published reports corroborate the scale of activity, but their totals cannot be spliced into this history. Emsisoft's Summer 2025 analysis reported approximately 2,395 ransomware.live listings for Q1 2025 and 1,496 for Q2 2025. It explicitly used publication dates. The observation-date history instead contains 2,386 and 1,666. Different dates and database vintages prevent a simple reconciliation.

Check Point's Q1 2026 report counted 2,122 postings through its own monitoring, comprising 732 in January, 684 in February, and 706 in March. This supports the general scale, but it is not a ransomware.live discovery-date count. Its account of roughly 390 Cl0p victims associated with the Q1 2025 mass-exploitation burst is more useful as evidence of campaign-driven volatility.

Bridewell's Q3 2026 analysis reported 2,889 listings across 111 groups. Its attack-date-filtered monthly chart showed 970 in July, 1,064 in August, and 855 in September. Those figures differ from the observation-date history above. The report supports the conclusion that activity was elevated, but its headline total does not replace the target-aligned baseline.

The composition of recent activity also matters. July–October records included 538 attributed to The Gentlemen, 499 to Qilin, and 112 to Cl0p. The first two together accounted for about 24.6% of the total; Cl0p accounted for about 3%. The higher level was therefore not predominantly a single Cl0p burst. That supports persistence more than a one-campaign explanation would, while leaving room for other concentrated posting events.

One such event involves N0n. A HackerFeeds publication-date report recorded 18 N0n listings in September and 154 in October, within an October total of 1,127. The observation-date October count attributed 150 records to N0n. The difference in counting basis matters, but both show that an unusually active publisher contributed to October's strength. The official N0n page also showed a concentrated October 12 maritime and logistics batch and continuing November postings. This argues against assuming that every established group accelerated equally.

Access pipelines offer a weaker signal of persistence. A July 23, 2026 Group-IB report described approximately 14,700 pre-compromised FortiGate devices available to The Gentlemen's affiliates. An October 21, 2026 Group-IB/NyxLab investigation found more than 70,000 exposed credential records in the k0t campaign and victim overlap with Qilin and The Gentlemen. Direct affiliation remained unconfirmed, and many observed compromises dated to February–June 2026. These findings support continuing access to potential targets. They do not translate into equivalent numbers of organizations or future listings.

Finally, collection itself can expand. The official 2026 statistics page listed 89 newly added group entries, including N0n added on September 18. New entries can represent newly monitored operators or rebrands rather than new criminal capacity. They still matter because this question measures records collected, not a fixed universe of attackers.

What's non-obvious

The date field is part of the outcome, not a minor reporting detail. A listing published in December but discovered in January belongs in this forecast's quarter. A March publication first discovered in April does not. This means that differences between published reports can be legitimate rather than errors. Averaging their headline totals would blur the very distinction the question asks us to preserve.

The second less obvious point is that listing growth and growth in unique victims are different claims. New monitoring, batch releases, and separate entries by different groups can raise the count without an equivalent increase in unique organizations. Apparent placeholder and exposure pairs on the N0n page illustrate the uncertainty, but their record identities were not established. No independent organization-level deduplication is justified. These effects are part of the forecast target, not noise to remove.

Uncertainties

The largest uncertainty is whether the elevated late-2026 pace persists. Multiple active groups support that interpretation. Actor-specific posting surges argue against extrapolating every recent increase. A large exploitation campaign could raise the outcome sharply; effective disruption, migration between groups, or reduced public posting could lower it. The saved interval retains both possibilities.

The historical evidence also has limits. The series reflects the database available on the forecast date, not immutable snapshots of every earlier period. Corrections, deletions, mergers, and changes in discovery timestamps can alter historical totals. Sample records supported the interpretation of observation dates as discovery dates, but the entire historical record set was not independently audited. A complete identifier-level reconciliation would strengthen confidence in the baseline and explain more of the differences between reports.

Monitoring and publication practices remain uncertain. More group entries do not establish proportionate growth in listings. Device inventories and credential exposures do not establish a schedule of future extortion claims. Group-level records, documented coverage changes, and evidence that bulk campaigns are reaching publication would help distinguish persistent growth from temporary bursts.

The April 15, 2027 snapshot fixes the resolving count. Records removed or merged before that snapshot do not remain separately countable unless they survive as distinct entries. The forecast assumes a complete, verifiable resolving dataset. If the specified evidence cannot be obtained within the question's allowed process, the result is annulment rather than a substitute estimate from another tracker.