Leak sites are a marketing channel, not a victim list. Taking their numbers at face value produces wrong conclusions.
Ransomware leak sites exist to expose victims who did not pay. Their content is therefore biased: paying victims never appear, and some of those who do are exaggerated.
What you can extract
- Sector drift — a change in the group's target profile is a more reliable signal than any individual victim.
- Geographic focus — a new country entering the list usually means a new affiliate has come online.
- Initial access pattern — the group will not describe its method, but what victims share (the same VPN product, the same managed service provider) gives it away.
What you cannot
Total victim counts, ransom amounts and claimed data volumes cannot be verified. Do not put them in a report as metrics; if you must, state the source and that it is unverified.
Practical use
Use leak sites to scan your own supply chain. When a supplier appears on a victim list, your data may be in that leak too.
