Methodology & data sources
HackerFeeds collects public threat-intelligence feeds into one dataset and computes statistics across them — ransomware activity by month, group, sector and country; exploited vulnerabilities by vendor. This page explains where each feed comes from, how often it is collected, how the numbers are derived, and what the data can and cannot tell you.
Sources and collection schedule
| Feed | Source | What we collect | Collected |
|---|---|---|---|
| Ransomware victims | ransomware.live | Victim name, claiming group, sector, country, claim and discovery dates, leak-post summary | Every 30 minutes |
| Ransomware groups | ransomware.live | Group profiles, MITRE ATT&CK TTPs, IOCs, ransom notes, YARA rules, national CSIRT contacts | Daily |
| Vulnerabilities (CVEs) | NIST National Vulnerability Database (CVE API 2.0) | CVE ID, description, CVSS score, vector and severity, CWE weaknesses, references | Hourly |
| Known exploited vulnerabilities | CISA Known Exploited Vulnerabilities catalog | Vendor, product, date added, federal due date, required action, ransomware-campaign use | Daily |
| Website defacements | Zone-H | Defaced target, notifier (attacker handle), country, mirror link | Twice an hour |
| Data breaches | Have I Been Pwned breach catalog | Breach name, domain, breach date, exposed account count, data classes | Daily |
| Cybersecurity news | Publisher RSS feeds | Headline, link and excerpt, plus a short brief written by HackerFeeds that names the original source | Hourly |
Schedules are targets: if an upstream source is unavailable or rate-limits collection, a feed can fall behind until the next successful run.
How the numbers are computed
Ransomware counts are victims publicly claimed on ransomware leak sites, dated by the date the claim was posted. Each upstream record is stored once — later collections update it rather than adding a duplicate. Countries are normalised to ISO 3166 two-letter codes; victims whose location was not disclosed are counted in totals but excluded from country rankings, and the upstream “Not Found” sector placeholder is excluded from sector rankings.
Monthly reports, group activity and country profiles are computed from that stored dataset. Month-over-month changes compare complete calendar months; the current month is labelled as in progress. A group's “first seen” date is the first victim we hold for it, which may be later than the group's real first activity for older groups.
Severity labels on ransomware incidents are a HackerFeeds heuristic based on the claiming group, not an assessment of the individual incident's impact.
Exploited-vulnerability statistics join CISA's KEV catalog with NVD scoring. Average CVSS figures cover only the entries for which NVD data is available.
Computed statistics are cached for between 10 minutes and a week depending on how often they can change; a completed month's report does not change.
Limitations
- Leak-site posts are the threat actor's own claims. They are not independently verified, can be exaggerated or false, and occasionally repost earlier victims or name the wrong organisation.
- Coverage depends on what the upstream sources capture. Historical coverage before September 2021 is sparse.
- Many victims do not disclose a country or sector, so country and sector shares describe only the victims where that is known.
- Defacement records reflect what attackers report to Zone-H; breach records reflect what Have I Been Pwned has catalogued.
Ethics, corrections and citing
HackerFeeds does not download, host, view or redistribute stolen data. We record only the metadata of a public claim — who claimed it, against whom, and when — for awareness and defensive research.
If an entry about your organisation is inaccurate, or you need it reviewed, contact legal@hackerfeeds.com.
When citing HackerFeeds statistics, please link to the specific report page (for example a monthly ransomware report) and note the date you accessed it, since figures for the current month update as new claims are posted.