How ransomware gangs actually choose victims

We track ransomware groups’ public victim claims in a live graph — over 22,000 claimed victims across 270+ named crews since 2020, with around 1,100–1,200 new claims a month through late 2026. Watching that firehose daily teaches you things the headlines get wrong. The biggest one: most victims aren’t targeted. They’re found.

The opportunistic majority

The dominant model is not “a crew decides to attack Company X.” It’s industrialised opportunism:

1. A door opens somewhere — a newly exploitable VPN appliance, an exposed remote desktop, a phished credential sold on a market.
2. Scanning finds every instance of that door on the internet, indiscriminately. Your company isn’t on a list; your IP range is.
3. Initial access gets sold or handed off. Specialist “initial access brokers” sell footholds; ransomware affiliates buy them in bulk and work through the pile.
4. Only then does anyone look at who you are — mostly to set the ransom figure against your revenue.

This is why victim lists look so random: a regional logistics firm, a dental chain, a school district, a mid-size manufacturer, in the same week, from the same crew. They didn’t share an enemy. They shared a vulnerable appliance.

What the sector data actually shows

In our tracking, manufacturing is consistently the most-claimed sector, month after month — not because crews hate factories, but because mid-size manufacturers combine three attacker-friendly traits: legacy systems that are hard to patch, low tolerance for downtime (which makes them likelier to pay), and thinner security teams than banks or tech firms. Professional services, construction, healthcare and transportation round out the usual top tiers.

The pattern to internalise: sectors get hit in proportion to their exposed attack surface and their pressure to pay — not their headline value. When a sector’s share of claims surges above its own historical baseline, it usually traces back to one exploited product that sector happens to run.

The exceptions: when targeting is real

Genuine targeting exists at the margins. Big-game hunting crews do research large enterprises for multi-million-dollar demands. Some crews avoid hospitals and some specifically don’t care. Geography matters too — most major crews won’t touch victims in their home country or allied states, which is why “suspected origin” is a standard field in any serious tracker.

But even “targeted” attacks usually start from the same opportunistic access pool — the targeting happens after the foothold, when the affiliate realises what they’ve got.

One honest caveat about the data

Victim counts in any tracker — ours included — come from the crews’ own leak sites. They are claims, published by criminals as a pressure tactic, discovered by public trackers. Some are inflated, some are duplicates or re-victimisations, and victims who pay quickly may never be listed at all. Treat every ransomware statistic, from anyone, as a floor estimate with that bias baked in. Anyone quoting leak-site numbers as confirmed breaches is overclaiming.

What this means for defenders

• Your external attack surface is your victim-selection probability. Reduce internet-exposed services and you leave the pool attackers fish in.
• Patch the doors crews are using this month — that’s the KEV catalog’s ransomware flag, not the full CVE list.
• Assume brokers, not masterminds. The person who got in and the crew that ransoms you are usually different businesses. The gap between them is your detection window.

Go deeper

The live version of everything above: per-crew dossiers with claimed victims, sectors and suspected origin in the ransomware tracker, open machine-readable feeds (CC BY 4.0), and the daily movements in Probably Fine Daily. Related: ransomware-as-a-service explained.