Each dot represents the location of a ransomware attack, with the size of the dot depicting the number of records impacted.
This map updates daily and pinpoints the locations of each ransomware attack in the US, from 2018 to present day. Where available, it includes the ransom amount, whether or not the ransom was paid, the entity and industry that was targeted, and the strain of ransomware used. Our researchers search through state reports, industry news, and cybersecurity databases to find the latest ransomware attacks on US businesses, healthcare organizations, educational institutions, and government agencies.
Read our industry-specific reports:
- Ransomware attacks on US healthcare organizations
- Ransomware attacks on US schools and colleges
- Ransomware attacks on US government organizations
- Ransomware attacks on US businesses
You can also track global ransomware attacks through our map of worldwide ransomware attacks (updated daily).
Methodology
Our researchers have searched through state data breach sites, cybersecurity reports, high-authority news articles, and extensive cybersecurity databases to collate this list of ransomware attacks. Where possible, we have only included the names of companies that have been confirmed by relevant authorities or companies. This is the same for ransoms that have or have not been paid. Some may assume an entity has paid a ransom after data disappears from a hacker’s website, however, we do not make this assumption.
From April 1, 2023, we have also logged unconfirmed ransomware attacks posted on hackers’ websites. In these cases, we omit the company name until we can confirm the attack.
For a full list of sources, please request access here.
Data researchers: Charlotte Bond, Rebecca Moody