Appendix: Methodology

1. Ransomware Group Monitoring

BRITE monitored activity from over 150 ransomware groups, tracking their leak sites, extortion posts, and public disclosures. A group was considered “active” if it published at least one victim within the last 12 months. By March 2025, 96 groups met this threshold.

2. Victim Enumeration and Analysis

A total of 6,046 victims were identified through leak site monitoring, cross-validated with open-source intelligence and internal telemetry. For each victim, BRITE analysts determined:

• Industry classification using NAICS codes
• Headquarters location by country

Estimated company size based on publicly available financials or trusted databases

BRITE also leveraged the Black Kite platform to assess each victim’s cybersecurity posture before and after the incident, helping to identify patterns in susceptibility and exposure.

3. Dark Web and Telegram Intelligence

To complement leak site tracking, BRITE actively monitored ransomware blogs, Telegram channels, and dark web forums to identify group narratives, affiliate activity, and coordination patterns. This enabled the team to detect new groups quickly and contextualize victim disclosures beyond surface-level postings.

4. Limitations

The dataset reflects only publicly disclosed victims. Many incidents—especially those involving smaller companies or settled quietly—are never made public. As a result, this report represents a conservative baseline, with the actual number of ransomware attacks likely much higher.

BRITE uses standardized methodology to avoid overcounting. For example, attacks affecting chains of clinics, dealer networks, or affiliated subsidiaries are treated as a single victim where appropriate, unless separate disclosures exist.