Are these confirmed breaches?

No. Every row is a claim a ransomware group made on its own leak site to pressure a target. Some are exaggerated, some are recycled old data, and some victims never confirm anything.

The saver always fetches ransomwatch's current file, so you see the newest entries the project has published. Each row is dated, and the header shows the latest date, so you can judge how fresh the archive is.

Does it need an API key?

No — the file is served openly from GitHub with permissive CORS, so the browser reads it directly.

Does it work offline?

No. The list is fetched live, so offline it shows a short notice instead.

Yes — free, no download, in your browser. It links to nothing: there are no clickable leak-site addresses anywhere in the saver.

What is double extortion?

It is a tactic where attackers both encrypt a victim's systems and threaten to leak stolen data, so the victim is pressured even if they can restore from backups.

What does the date on each row mean?

It comes from the discovered field, the time ransomwatch first found the post on a leak site. It is not the date of the attack.

Does a listing prove an organisation was breached?

No. It records what a criminal group chose to post. The listing alone does not confirm the breach, any ransom demand or whether it was paid.

Ransomware Victim Feed Screensaver

The Ransomware Victim Feed screensaver shows the most recent entries from ransomwatch, an open-source archive that mirrors the victim listings ransomware gangs publish on their own leak sites. Every row is an unverified criminal claim, dated, not a confirmed breach. It's free, needs an internet connection, and ESC exits.

How the Ransomware Victim Feed screensaver works

The saver reads ransomwatch's public posts.json straight from GitHub in your browser — no key, no server, no third-party aggregator.

That file holds roughly 16,000 archived listings with the newest at the end; the saver keeps only the latest 40 and scrolls them slowly.

Each row shows the name the gang posted, the group that claimed it in accent colour, and the date ransomwatch's collector first saw the post.

It refreshes every 30 minutes, and several copies on screen share one download rather than each fetching the file.

How ransomware leak sites work

Many ransomware groups combine two threats: encrypting a victim's files and stealing data to threaten publication. To add pressure, groups run leak sites where they post the names of organisations they claim to have hit. These sites sit behind Tor hidden services, which is why a tracker has to route its requests through Tor.

The ransomwatch project describes itself as a transparent ransomware claim tracker. It runs on GitHub Actions, visits the monitored extortion sites and parses what they list. Its posts.json file has three fields per entry: post_title, group_name and discovered, the timestamp at which ransomwatch found the post. The repository's owner has archived it and made it read-only, so it is worth checking when the file last changed.

Treat each row as a claim, not a confirmed incident. The title is whatever the group chose to post, so it may be a company name, a domain or an abbreviation, and by itself it may not identify one organisation. The date is when the post was discovered, not when the attack happened, so the intrusion itself may be considerably older.

A worked example

A row might read NF Stroth & Associates — PLAY — claimed 2025-06-16: the Play group listed that firm on its leak site on that date. Whether data was actually taken, and whether the organisation ever confirmed it, is not something the feed knows. Security teams use walls like this as an early-warning board, not as evidence.

Settings & tips

Scroll speed sets how fast the wall creeps; leave it low for a quiet operations-room display.
The header shows the date of the newest entry — check it, because ransomwatch's collector runs on its own schedule and can lag.
Names come straight from criminal postings and can be misspelled, duplicated, or simply false.

Frequently asked questions

Are these confirmed breaches?: No. Every row is a claim a ransomware group made on its own leak site to pressure a target. Some are exaggerated, some are recycled old data, and some victims never confirm anything.
Is the data live?: The saver always fetches ransomwatch's current file, so you see the newest entries the project has published. Each row is dated, and the header shows the latest date, so you can judge how fresh the archive is.
Does it need an API key?: No — the file is served openly from GitHub with permissive CORS, so the browser reads it directly.
Does it work offline?: No. The list is fetched live, so offline it shows a short notice instead.
Is it free?: Yes — free, no download, in your browser. It links to nothing: there are no clickable leak-site addresses anywhere in the saver.
What is double extortion?: It is a tactic where attackers both encrypt a victim's systems and threaten to leak stolen data, so the victim is pressured even if they can restore from backups.
What does the date on each row mean?: It comes from the discovered field, the time ransomwatch first found the post on a leak site. It is not the date of the attack.
Does a listing prove an organisation was breached?: No. It records what a criminal group chose to post. The listing alone does not confirm the breach, any ransom demand or whether it was paid.

← All Security & Privacy screensavers