ransomware.ninja

public api

The victim feed, as JSON.

Everything the front page shows comes from these endpoints — and they are public. Anonymous, free, no API key, no signup. Base URL is https://ransomware.ninja/api. All endpoints are rate-limited to 60 requests/minute per client and most responses are cached server-side for 5 minutes, which matches how often the ingester runs — polling faster than that buys you nothing.

JSON only no auth 60 req/min 5-min cache HTTPS only

The feed

start here — this is the machine-readable victim feed

GET /api/ransomware/victims

The live leak-site feed: who was named, by which crew, when, and where. This is the feed — poll it (respecting the rate limit) to build alerts, dashboards or your own RSS bridge. Rows come from the enriched victim set, which carries sector and country attribution and the group's own claim text.

Query parameters

param	default	range	meaning
limit	50	1–200	rows per page
offset	0	0–5000	pagination offset
days	90	1–3650	lookback window on discovery date
group	—	≤80 chars	exact group name, case-insensitive
sector	—	≤80 chars	exact sector name, case-insensitive
country	—	≤8 chars	country code, case-insensitive
q	—	≤120 chars	victim-name substring search

Example

curl -s "https://ransomware.ninja/api/ransomware/victims?limit=2&days=30"

Response shape

{
  "count": 2,
  "offset": 0,
  "victims": [{
    "victim": "Example Corp",
    "group": "lockbit3",
    "sector": "Manufacturing",        // nullable
    "country": "US",                    // nullable
    "discovered": "2026-08-30T14:02:11+00:00",
    "claim": "…the group's own leak-site copy, capped at 600 chars…",
    "url": "…"                       // nullable
  }]
}

Headline stats

GET /api/ransomware/pulse

The front page's counters in one call: victims named in the last 24h/7d/30d, active crews, all-time claims, week-over-week movers, and the 30-day sector and country breakdowns. Time-window counts use the enriched victim set only, so they match what the feed shows; claims_all_time spans the deep history back to 2021.

Response shape

{
  "victims_24h": 14, "victims_7d": 96, "victims_30d": 402,
  "victims_tracked": 1500,          // enriched set size
  "latest_claim": "2026-08-31T…",
  "groups_active": 74, "groups_tracked": 210,
  "claims_all_time": 19500,
  "movers": [{"group", "this_week", "last_week", "delta"}],
  "top_sectors_30d": [{"sector", "n"}],
  "top_countries_30d": [{"country", "n"}],
  "generated": "…ISO timestamp…",
  "scope": "enriched victim set (sector/country attributed)"
}

Groups

GET /api/ransomware/groups

The crew league table. victims_total spans both victim sources back to 2021; victims_90d is current operational tempo. signal_actors is the bridge into the Ninja Signal actor graph.

Query parameters

param	default	range	meaning
status	active	active \| dormant \| historical \| all	group lifecycle filter
limit	60	1–300	rows returned

Response shape

{
  "count": 60, "status": "active",
  "groups": [{
    "group", "status", "victims_total", "victims_90d",
    "leak_sites",                       // count of known sites
    "first_seen", "last_seen",          // ISO, nullable
    "signal_actors": ["…"]
  }]
}

GET /api/ransomware/group/{name}

The full dossier on one crew: status and tempo, MITRE techniques observed, leak-site infrastructure, targeted industries, sectors and countries hit, a 24-month monthly timeline, and the 25 most recent victims. Name matching is case-insensitive; unknown names return 404, names with characters outside [A-Za-z0-9 ._$@!+&()-] return 400.

Example

curl -s "https://ransomware.ninja/api/ransomware/group/lockbit3"

Response shape

{
  "name", "status", "type", "victims_total",
  "first_seen", "last_seen", "profile_url", "site_count",
  "techniques": [{"name", "id", "tactic"}],   // MITRE ATT&CK
  "leak_sites": ["…"],
  "targets_industries": ["…"],
  "signal_actors": ["…"],
  "sectors_hit": [{"sector", "n"}],
  "countries_hit": [{"country", "n"}],
  "timeline": [{"month": "2026-08", "n"}],   // both victim sources
  "recent_victims": [{"victim", "sector", "country", "discovered"}]
}

Breakdowns & trend

GET /api/ransomware/sectors

Victims and distinct groups per sector over a window. Param days (default 365, range 7–3650).

Response shape

{ "days": 365, "sectors": [{"sector", "victims", "groups"}] }

GET /api/ransomware/countries

Victims per country over a window. Param days (default 365, range 7–3650).

Response shape

{ "days": 365, "countries": [{"country", "victims"}] }

GET /api/ransomware/trend

Whole-ecosystem victims named per month, from both victim sources (deep history + enriched set). Param months (default 24, range 3–60).

Response shape

{ "months": 24, "trend": [{"month": "2026-08", "victims"}] }

Fair use

This API exists so the data gets used. Build on it. Please cache on your side, stay under the rate limit, and attribute ransomware.ninja when you republish. Leak-site claims are what the attackers say they have — treat a listing as an allegation, not a confirmed breach.

get alerted when your suppliers appear here — coming to watchlists