Pulse
Slice by source, severity, sector, threat actor, compliance window — every panel pivots back to the underlying records.
Slice by source, severity, sector, threat actor, compliance window — every panel pivots back to the underlying records.
Named crews ranked by claimed victims — leak-site posts, press reports, and any filing that named an actor. Claims stay unconfirmed until a regulatory filing matches; the confirmed column counts exactly those matches.
| # | Actor | Claims · of window | 90-day trend | Confirmed | Top sector · of crew |
|---|---|---|---|---|---|
| 01 | thegentlemen | 3627.1% | ▲ 37% | ✓ 82.3% | Manufacturing20% |
| 02 | qilin | 3587.0% | ▲ 9% | 00.0% | Manufacturing22% |
| 03 | cl0pnew | 1312.6% | ▲ new | 00.0% | Information32% |
| 04 | akira | 1062.1% | ▼ 35% | ✓ 21.9% | Manufacturing32% |
| 05 | inc ransom | 1062.1% | ▼ 9% | ✓ 10.9% | Professional Services23% |
| 06 | krybit | 971.9% | ▲ 64% | 00.0% | Professional Services17% |
| 07 | deadlocknew | 921.8% | ▲ new | 00.0% | Professional Services28% |
| 08 | safepay | 751.5% | ▲ 15% | ✓ 22.8% | Manufacturing27% |
5,088 rows · 90-day window·trend vs prior 90dtop 8 of the 30 crews the API ranks · open claims feed →
Change in claim volume — scaling up (red) vs cooling off (teal).
VERIS top-level action — hacking, malware, social, error, etc.
Orthogonal flags — supply chain, delayed discovery, what the actor did with the data.
Claimed victims by sector — where each crew concentrates fire.
| Manufacturing | Professional Services | Information | Retail | Healthcare | |
|---|---|---|---|---|---|
| thegentlemen | 69 | 43 | 44 | 39 | 30 |
| qilin | 66 | 50 | 27 | 23 | 16 |
| cl0p | 12 | 11 | 29 | 16 | 5 |
| akira | 34 | 17 | 10 | 14 | 3 |
| inc ransom | 19 | 24 | 11 | 5 | 16 |
| krybit | 9 | 16 | 13 | 10 | 11 |
every leak-site claim is coded malware by the ingest synthesizer, so that bar counts the claim population
VERIS sub-tactics — top 10 by count.
same caveat: ransomware is set on every claim at ingest — 47 of it comes from filings
ransom demanded and actor named are omitted: the synthesizer sets both on every leak-site claim, so they count the claim population rather than describing it. The flags below are conditional or filing-derived.