How to Check If Your Company Data Is on a Ransomware Leak Site
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Ransomware groups publicly list victim organizations on dedicated leak sites to pressure them into paying ransoms. Checking whether your company appears on one of these sites takes under 20 minutes using free aggregator tools, no enterprise threat intelligence contract required.
Double extortion became the default ransomware model in 2020: groups encrypt your files and simultaneously exfiltrate your data. If you do not pay, they publish it. Over 7,400 organizations were listed on active leak sites in 2025 across groups including LockBit 3.0, RansomHub, Play, Akira, Black Basta, and Qilin. Many of these sites are accessible through standard web browsers via clearnet mirrors, Tor access is not required for initial reconnaissance.
Three scenarios make this check urgent: you experienced a security incident in the past 90 days and need to confirm whether data was exfiltrated before encryption; you received a ransom demand referencing specific stolen files; or your security leadership has requested confirmation that your organization does not appear on any active leak sites. Run this check regardless of whether you have had a confirmed incident. The median time from initial access to first exfiltration is 17 minutes, and many listings appear weeks before victims know they were compromised.
Step 1: Start with RansomLook for Multi-Group Coverage
RansomLook (ransomlook.io) is the fastest free starting point. It aggregates victim listings from over 100 active ransomware group leak sites into a single searchable interface, updated in near-real-time.
Go to ransomlook.io and use the search bar at the top of the page. Search for your company's primary domain name (example.com), your company name, and any known subsidiary names or former company names. Use partial strings, search "acme" not "Acme Corporation", because ransomware groups format victim names inconsistently.
Results show the group that posted the listing, the date posted, the claimed data volume, and a description of what was stolen. If your company appears, record the group name, posting date, and claimed data description before taking any other action. Do not click through to the actual leak site from a corporate device.
For groups not yet indexed by RansomLook, check ransomwatch.telemetry.ltd as a secondary source. Ransomwatch monitors over 60 active group sites and posts raw JSON feeds of new victims updated every 30 minutes. Use the search function or download the JSON feed and grep for your company name.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Step 2: Run a HaveIBeenPwned Domain Search for Credential Exposure
A RansomLook result tells you whether your company was named as a victim. It does not tell you whether employee credentials from your domain are circulating in stealer logs and criminal marketplaces, which is often a precursor to ransomware.
HaveIBeenPwned's domain search (haveibeenpwned.com/DomainSearch) checks your email domain against every breach in its database. Enter your company domain and verify ownership via a DNS TXT record or email verification. Results show every email address from your domain that appears in breach data, grouped by breach source.
This check covers three separate threat vectors: credential stuffing risk from historical breaches, infostealer log data where full browser credential dumps include your employees' corporate accounts, and breach data from SaaS tools your employees use with their corporate email address.
For more granular infostealer-specific data beyond what HIBP covers, check DeHashed (dehashed.com) with a free account. DeHashed indexes a broader range of credential dump sources including Telegram-distributed stealer logs. Free accounts have daily query limits but are sufficient for an initial assessment. Pay attention to results dated in the past 90 days, these represent recent stealer activity, not just historical breaches.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Step 3: Direct Verification If You Find a Listing
If RansomLook or ransomwatch returns a hit for your organization, verify the listing directly before escalating to legal and executive leadership. False positives occur, particularly for common company names, and you want to confirm the listing describes your organization before triggering an incident response.
Access the listed group's leak site using Tor Browser (torproject.org/download) on an isolated, non-domain-joined device. Do not use a corporate laptop, a device connected to corporate VPN, or a browser with any logged-in accounts. The Tor Browser routes your traffic through the anonymization network and prevents the ransomware group's web server from logging your corporate IP address.
For groups that maintain clearnet mirrors, many do, including RansomHub and Play, you can access the site directly from the Tor Browser without configuring onion addresses. Check the group's current listings page and search for your company name.
Confirm the listing by noting: the exact company name used, any sample files posted as proof (ransomware groups routinely post file directory screenshots or small sample documents to prove possession), the claimed data volume and description, and the posted deadline if the group is still actively threatening publication.
Report your findings to legal counsel before taking any public action. Breach notification obligations in most jurisdictions are triggered by confirmed exfiltration, not just encryption.
What to Do Immediately If You Find a Listing
A confirmed listing means data has already been exfiltrated and is either publicly available or held pending payment. The response priorities in the first four hours are forensic preservation, legal notification, and scope assessment, in that order.
Preserve before remediating. Do not wipe affected systems before capturing forensic images. Destroying forensic evidence before scope is known makes attribution, insurance claims, and regulatory reporting significantly harder. If you have an IR retainer, engage your retainer firm before touching anything.
Notify legal counsel immediately. In-house counsel or external privacy counsel needs to assess your breach notification obligations. Most US states have notification timelines of 30 to 72 hours from confirmed discovery. GDPR requires notification within 72 hours. The clock starts when you have a reasonable belief that personal data was exfiltrated, a public listing meets that standard.
Assess scope using the listing evidence. Sample files or directory screenshots posted by the ransomware group tell you which file servers were accessed and approximately when. Cross-reference against your asset inventory to identify affected systems.
Do not contact the ransomware group directly. Any negotiation should go through a specialized ransomware negotiation firm (Coveware, Mandiant, Kroll) that understands OFAC sanctions screening requirements. Paying groups on the OFAC SDN list is a federal violation regardless of whether you are the victim.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
What Free Tools Miss and When to Pay for Monitoring
Free tools like RansomLook and ransomwatch are reactive: they find you after you have already been listed. They do not alert you in real time, they do not monitor Telegram channels where stolen data is sold before being posted publicly, and they do not cover private negotiations or groups that sell data quietly without publishing it.
The gap between exfiltration and public listing averages 12 days based on ransomware group behavior tracked through 2025. During that window, your data may be circulating in private criminal channels that free tools do not index.
Paid dark web monitoring services (Recorded Future, Flare, Cybersixgill, SOCRadar) monitor Telegram data markets, private forums, and ransomware group chat infrastructure in near-real-time. They alert on your company name, domain, and specific data patterns, Social Security number formats, credit card number patterns, IBAN formats, as they appear. Annual contracts start around $10,000 for SMB tiers.
The practical threshold for investing in paid monitoring: if your organization holds personal data on more than 50,000 individuals, operates in healthcare or financial services, or has experienced a ransomware incident in the past 24 months, paid monitoring is justified by breach notification cost avoidance alone. A single GDPR or HIPAA notification event costs more than a multi-year paid monitoring contract.
The bottom line
Checking whether your company data is on a ransomware leak site takes 20 minutes and costs nothing using RansomLook and ransomwatch. Run the check now with your domain name, company name, and any subsidiary names. If you get a hit, preserve forensic evidence, notify legal counsel, and assess scope using the listing evidence before remediating anything. Free monitoring is reactive, if your organization holds personal data on more than 50,000 individuals or operates in a high-target sector, invest in paid dark web monitoring to close the 12-day window between exfiltration and public listing.
Frequently asked questions
What is a ransomware leak site?
A ransomware leak site is a website operated by a ransomware group where they publish stolen data from victim organizations that refuse to pay the ransom. These sites serve as proof of breach and as pressure tactics. Most are hosted on Tor but many groups maintain clearnet mirrors for wider visibility. Double extortion, combining file encryption with data theft and threatened publication, is now used by over 89% of active ransomware groups.
How do I search for my company on a ransomware leak site?
Use RansomLook (ransomlook.io) as your starting point. It aggregates victim listings from over 100 ransomware group sites into a single searchable interface. Search your company domain, company name, and any subsidiary names using partial strings. Also check ransomwatch.telemetry.ltd as a secondary source. If you need to verify a listing directly, use Tor Browser on a non-corporate device to access the group's site without exposing your corporate IP address.
What do I do if I find my company listed on a ransomware leak site?
Immediately preserve forensic evidence on affected systems before any remediation. Notify legal counsel within 1 hour, breach notification timelines under state law, GDPR, and HIPAA begin at confirmed discovery. Use the sample files or directory screenshots posted by the group to scope which systems were accessed. Brief your cyber insurance carrier within the policy notification window. Do not contact the ransomware group directly, engage a qualified negotiation firm that conducts OFAC sanctions screening.
Is it safe to visit ransomware leak sites?
Ransomware leak sites can serve malicious content, and visiting from a corporate device exposes your corporate IP address to the operators. For initial reconnaissance, use aggregator tools like RansomLook which do not require direct site access. If you must verify a listing directly, use Tor Browser on a non-domain-joined device not connected to corporate VPN. Never use a corporate laptop or a device with any logged-in corporate accounts.
How quickly do ransomware groups post data after an attack?
The median time from initial compromise to first data exfiltration is 17 minutes. The average time from confirmed exfiltration to public listing on a leak site is 12 days, though this varies by group. Some groups post within 24 hours of a failed ransom negotiation; others hold data for weeks and sell it privately before publishing. This gap is why paid real-time monitoring catches listings that free tools miss.
Can I get data removed from a ransomware leak site?
Removing data from a ransomware leak site is not reliably achievable through legal means. Law enforcement takedowns occasionally remove specific sites, but operators typically rebuild under new names. Paying the ransom does not guarantee deletion, groups frequently retain copies and resell data regardless of payment. Focus resources on breach notification compliance, credential rotation, and monitoring for subsequent use of the leaked data rather than pursuit of takedown.
What does free dark web monitoring miss compared to paid services?
Free tools only index public leak site posts after they go live. They do not cover private Telegram data markets where stolen data is sold in the 12-day window before public publication, private ransomware group negotiations, criminal forums requiring registration, or stealer log marketplaces. Paid services (Recorded Future, Flare, Cybersixgill) monitor these private channels in near-real-time and alert on specific data patterns matching your organization's data footprint.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.