Real Time Data Breach Intelligence

Access validated data on the latest data breaches and ransomware attacks to identify plaintiffs and build your case before the competition.

03/26/2026

Latest Ransomware Breaches

Gulshan Management Services

377,082

Insightin Health

155,086

Catalyst RCM

139,964

Spindletop Center

88,863

Alpine Ear, Nose & Throat, PLLC

65,648

Live map of confirmed US ransomware Attacks

               

96%

Of ransomware attacks now involve data theft, not just encrypted files. This provides the “injury in fact” required to survive motions to dismiss based on Article III standing.1

1 in 5

Ransomware attacks now result in immediate class action filings. Targeting these breaches isn’t just speculative—it’s a statistically high-yield litigation strategy.2

284 Days

Average time to identify and contain a breach. CyEx helps uncover the breach early, allowing you to get ahead with a solution.3

95%

Of major filings are centralized into a single MDL. Early access to data is the key to securing a lead role before the docket locks.4

Database of US ransomware attacks

Want Monthly Updates on the top breaches? Sign up now for our monthly data breach digest.

Name(Required)
Email(Required)
Privacy(Required)

Frequently Asked Questions

Where does this data come from?

Our breach figures are based solely on official reports filed by impacted entities with state Attorneys General, the Department of Health and Human Services (HHS) OCR breach tool, and other regulatory bodies. We do not use unverified figures quoted by ransomware groups on dark web leak sites, as these are often inaccurate.

The “Top Ransomware Attacks” and live maps are updated daily via Comparitech’s data feed to ensure attorneys have the most current data for identifying potential plaintiffs.

Many recent attacks have unknown record counts while we wait for formal breach notifications to be processed and published by the relevant authorities. Once that information is identified, the record tracker is automatically updated.

Currently, this page focuses specifically on ransomware attacks to provide the most accurate and “clean” data possible. In the near future, this feed will include all breaches identified and reported.

While our historical database includes data from 2018 onwards, the interactive maps and charts focus on the most actionable data from 2022 to the present.

Hundreds of claims are made by ransomware groups each month but until these are verified and acknowledged by the entity involved, we will keep these attacks as unconfirmed. Once the organization issues a statement and/or data breach notification about the attack, we will change its status to confirm and add it into our tracker.

Enter your email for access