Ransomware incident investigations
We investigate the company, not the hackers.
After a ransomware attack, the question for the people affected is whether the company protected their information the way the law requires. We open a file on every breach reported to a state regulator and track what the record confirms.
- Files open
- 13,906
- Filed as ransomware
- 2
- State regulators
- 42
Free case review
Tell us which company notified you. An attorney reviews it at no cost.
Filed as ransomware
All 2Newest files
Incident index- Del Monte Foods Corporation II Inc.Vermont Attorney General · Filed October 29, 2026Count not stated
- The Research Foundation for Mental Health, Inc.Vermont Attorney General · Filed October 29, 2026Count not stated
- CenterPoint Energy, Inc.Texas Attorney General · Filed October 28, 2026Count not stated
- Quantum Health, Inc.Vermont Attorney General · Filed October 28, 2026Count not stated
- EyeMed Vision Care, LLCTexas Attorney General · Filed October 28, 2026Count not stated
- DMW Retail Enterprises LLC dba Kult of Athena (KOA)Texas Attorney General · Filed October 28, 2026Count not stated
- Alabama Fire CollegeTexas Attorney General · Filed October 28, 2026Count not stated
- Ford Audio-Video Systems, LLCTexas Attorney General · Filed October 28, 2026Count not stated
Four questions in every file
These decide whether a ransomware breach becomes a legal claim.
- Was data copied out, or only locked?
- Encryption alone disrupts a company. Exfiltration puts your records in criminal hands. The filing and the notice letter usually say which happened, and that changes the claim.
- How long were the attackers inside?
- The gap between first access and discovery shows whether the company was watching its own network. Long dwell times are a recurring theme in negligence claims.
- Was the notice sent on time?
- State laws set deadlines for telling the people affected. A notice sent months after discovery can cost people the chance to protect themselves.
- What safeguards were missing?
- Unpatched systems, no multi-factor sign-in and unencrypted backups are the failures most often cited when a company is sued after a ransomware attack.
Cross-check with outside trackers
Researchers and agencies we watch alongside the state filings. Use them to see what has been said publicly about an attack.
- GovernmentCISA #StopRansomware alertsOfficial U.S. government advisories and statements on active ransomware threats.
- Leak-site trackerRansomware.liveA free tracker of victim posts on ransomware group leak sites.
- Leak-site trackerComparitech ransomware trackerA map and database of ransomware attacks on organizations around the world.
- Leak-site trackerSOCRadar ransomware victimsA free intelligence tool listing organizations named by ransomware groups.
- Leak-site trackerRansomDBA searchable database of ransomware groups and the victims they claim.
- Leak-site trackerRansomFeedA feed that monitors ransomware leak sites and logs new claims as they appear.
- ResearchGroup-IB ransomware notesA library of ransom notes left by known ransomware families.
- NewsThe Hacker News: ransomwareSecurity news coverage of ransomware attacks, groups and arrests.
- NewsSuspectFileIndependent reporting on ransomware incidents and data leaks.
Outside sites, not affiliated with us. Leak-site trackers repeat what criminal groups claim; a listing there is not proof that a company was attacked or that your information was taken. Your company’s official breach notice and its state filing are the record that matters for a claim.
Open your own file with the attorney
David S. Harris, Esq. has practiced law since 1997. Tell him which company notified you and what was taken. The review is free, and cases are taken on contingency: no fee unless you recover.
Florida Bar No. 0112739
786-306-7278Attorney advertising. A file reflects a public regulator filing; it does not mean a lawsuit has been filed or that the company did anything unlawful. Incidents are flagged ransomware only when the company’s filing says so. Prior results do not guarantee a similar outcome.