Pulse
Slice by source, severity, sector, threat actor, compliance window — every panel pivots back to the underlying records.
Slice by source, severity, sector, threat actor, compliance window — every panel pivots back to the underlying records.
Named crews ranked by claimed victims — leak-site posts, press reports, and any filing that named an actor. Claims stay unconfirmed until a regulatory filing matches; the confirmed column counts exactly those matches.
| # | Actor | Claims · of window | 90-day trend | Confirmed | Top sector · of crew |
|---|---|---|---|---|---|
| 01 | qilin | 3636.8% | ▲ 14% | ✓ 10.3% | Manufacturing24% |
| 02 | thegentlemen | 3636.8% | ▲ 12% | ✓ 61.7% | Manufacturing21% |
| 03 | n0nnew | 1693.2% | ▲ new | 00.0% | Transportation23% |
| 04 | cl0pnew | 1112.1% | ▲ new | 00.0% | Information26% |
| 05 | akira | 991.9% | ▲ 14% | ✓ 22.1% | Manufacturing40% |
| 06 | inc ransom | 921.7% | ▼ 5% | ✓ 11.1% | Professional Services23% |
| 07 | stormnew | 891.7% | ▲ new | ✓ 44.5% | Manufacturing20% |
| 08 | krybit | 801.5% | ▲ 23% | 00.0% | Professional Services17% |
5,315 rows · 90-day window·trend vs prior 90dtop 8 of the 30 crews the API ranks · open claims feed →
Change in claim volume — scaling up (red) vs cooling off (teal).
VERIS top-level action — hacking, malware, social, error, etc.
Orthogonal flags — supply chain, delayed discovery, what the actor did with the data.
Claimed victims by sector — where each crew concentrates fire.
| Manufacturing | Information | Professional Services | Healthcare | Retail | |
|---|---|---|---|---|---|
| qilin | 71 | 38 | 34 | 12 | 19 |
| thegentlemen | 70 | 49 | 39 | 45 | 37 |
| n0n | 20 | 22 | 19 | 19 | 8 |
| cl0p | 12 | 20 | 12 | 3 | 12 |
| akira | 38 | 6 | 18 | 3 | 11 |
| inc ransom | 19 | 7 | 20 | 14 | 3 |
every leak-site claim is coded malware by the ingest synthesizer, so that bar counts the claim population
VERIS sub-tactics — top 10 by count.
same caveat: ransomware is set on every claim at ingest — 47 of it comes from filings
ransom demanded and actor named are omitted: the synthesizer sets both on every leak-site claim, so they count the claim population rather than describing it. The flags below are conditional or filing-derived.