Slice by source, severity, sector, threat actor, compliance window — every panel pivots back to the underlying records.
Named crews ranked by claimed victims — leak-site posts, press reports, and any filing that named an actor. Trend and targeting are computed across the window; claims stay unconfirmed until a regulatory filing matches.
| Actor | Claims | 90-day trend | Top sector |
|---|---|---|---|
| thegentlemen | 323 | ▲ 27% | Manufacturing |
| qilin | 319 | ▼ 13% | Professional Services |
| dragonforce | 125 | ▼ 25% | Professional Services |
| akira | 110 | ▼ 39% | Professional Services |
| lockbit5 | 110 | ▼ 51% | Professional Services |
| inc ransom | 105 | ▼ 22% | Professional Services |
| deadlock | 96 | ▲ new | Manufacturing |
| safepay | 89 | ▲ 197% | Professional Services |
4,565 rows · 90-day window·trend vs prior 90d · + 22 more named actors
Change in claim volume — scaling up (red) vs cooling off (teal).
VERIS top-level action — hacking, malware, social, error, etc.
Orthogonal flags — zero-day, supply chain, DOJ-delayed, etc.
Claimed victims by sector — where each crew concentrates fire.
| Professional Services | Manufacturing | Information | Healthcare | Retail | |
|---|---|---|---|---|---|
| thegentlemen | 34 | 52 | 31 | 25 | 13 |
| qilin | 50 | 37 | 23 | 28 | 26 |
| dragonforce | 28 | 16 | 11 | 9 | 6 |
| akira | 27 | 22 | 6 | 5 | 12 |
| lockbit5 | 22 | 13 | 5 | 8 | 8 |
| inc ransom | 23 | 11 | 14 | 11 | 3 |
VERIS sub-tactics — top 10 by count.
Top 10 by count. Mostly leak-site claims, so these are the crew's own naming, not forensic confirmation.