Leakly index
Global leak and vulnerability index
Where ransomware claims, actively exploited vulnerabilities and verified leaks are landing this week. Every number comes from a public feed named below.
Data through 08 Nov 2026 (UTC), the last complete day. Generated 2026-11-09 20:19:33 UTC.
Composite index
55.9 +3.6 vs previous 7 days Last 7 days (02 Nov 2026 to 08 Nov 2026) (UTC) 50 = a typical week over the last 182 daysNo feed data for this window: Ransomware. Shown as n/a, not zero; the composite uses the other categories.
- Ransomwaren/a no feed data weight 30%
- KEV21 3 this window -70% weight 25%
- Critical CVEs100 86 this window +438% weight 15%
- Breaches25 1 this window 0% weight 15%
- Leakly100 63 this window +320% weight 15%
Map
Skip the map and go to the country table- Leakly story (score 50+, subject's home country)
- ransomware.live surge (10+ claims and 1.5x the country's typical week)
- CISA KEV additions (vendor's home country; orange edge = known ransomware use)
Map: D3 (ISC) · Equal Earth projection · Natural Earth via world-atlas (public domain / ISC). Self-hosted.
By category
Area: each category's weighted share of the composite. Colour: change against the previous 7 days down · up
Flares in this window
- CISA KEV 2 exploited vulnerabilities added for vendors based in United States: CVE-2024-27834, CVE-2026-19868.
- Leakly story Apple reportedly gave iOS 28 engineers six weeks to code, two to integrate
- Leakly story Apple could turn Siri into an AI agent as early as next year, Gurman says
Not on the map
- 1 KEV additions have no single vendor home country on record: CVE-2026-119977 (WordPress).
- Leakly: Siri chief Mike Rockwell is weighing whether to step back, report says has no located main subject.
- Leakly: OpenAI's Dots can now pull sign-in codes from your inbox to log in for you has no located main subject.
- Leakly: Steven Spielberg's next film is a Western he hopes to shoot next year, his cinematographer says has no located main subject.
- Leakly: Thunder acquire Nique Clifford from the Kings for two second-round picks has no located main subject.
Countries
| Country | Ransomware claims | KEV, vendor HQ | Leakly stories | Country score | Ransomware per 10M | Score per 10M |
|---|---|---|---|---|---|---|
| United States | n/a | 2 | 13 | 38.1 | n/a | 1.11 |
| South Korea | n/a | 0 | 1 | 2.1 | n/a | 0.41 |
Per 10M uses World Bank population (2025). Some country names are shown as ISO codes.
How the index works
| Category | Weight | Country used | Why |
|---|---|---|---|
| Ransomware claims | 30% | Victim country | Direct harm with a victim country. Counts are attacker claims scraped from extortion sites by ransomware.live, not confirmed incidents. |
| Exploited vulnerabilities (CISA KEV) | 25% | Vendor's home country | Confirmed in-the-wild exploitation. Located at the vendor's home country (Wikidata), never the victim's. |
| Critical CVEs (NVD, CVSS v3 critical) | 15% | No (global only) | Volume of newly published critical-severity vulnerabilities: exposure, not confirmed exploitation. No country. |
| Breach disclosures (Have I Been Pwned) | 15% | No (global only) | Breaches newly loaded into HIBP (verified or unverified, never fabricated or spam lists). Irregular cadence. No country. |
| Leakly-verified leaks | 15% | Main subject's home country | Leaks Leakly published and sourced, by leak date. Located at the main subject organisation's home country (Wikidata) when there is one. |
- Sub-index per category: 50 × the 7-day count ÷ the median 7-day count over the last 182 days, capped at 100. 50 means a typical week; 100 means at least double.
- Composite: the weighted sum of the five sub-indexes. It is recomputed every day for the 7 days ending on the last complete UTC day; the week slider steps through the last 26 full weeks (Monday to Sunday).
- Country score: for the located categories only, each country's share of a typical week's global count, weighted the same way (Ransomware 30, KEV 25, Leakly 15, rescaled to 100). Per-capita divides by population per 10M.
- Flares: Leakly stories scoring 50+ that are not debunked; ransomware.live country surges (10+ claims and at least 1.5x that country's median week); every CISA KEV addition, grouped by vendor home country.
- Ransomware counts are claims posted by criminal groups and collected by ransomware.live. Many are never confirmed. We show counts only: no victim names, no links to extortion sites.
- KEV and Leakly locations are the vendor's or subject's home country from Wikidata, not where anyone was attacked. US-based vendors and a US-first newsroom pull country scores toward the US; the per 10M columns adjust for population.
- Gap: ransomware.live months not yet fetched: 2026-06, 2026-07, 2026-08, 2026-09, 2026-11. Weeks in those months show ransomware as n/a (not zero) and the composite uses the other four categories.
- Coverage: ransomware 2026-04-26 to 2026-11-07; KEV 2026-04-28 to 2026-11-06; critical CVEs 2026-04-26 to 2026-11-08; breaches 2026-04-26 to 2026-11-03; Leakly 2026-08-18 to 2026-11-08 (UTC).
Sources
- Ransomware claims: ransomware.live (free API v2), attribution as the project requests. Not linked, because it lists extortion-site posts.
- Exploited vulnerabilities: CISA Known Exploited Vulnerabilities catalog (public domain).
- Critical CVEs: NIST National Vulnerability Database, CVE API 2.0. This product uses the NVD API but is not endorsed or certified by the NVD.
- Breach disclosures: Have I Been Pwned, licensed CC BY 4.0.
- Population: World Bank, Population, total (SP.POP.TOTL), CC BY 4.0.
- Home countries: Wikidata headquarters country (CC0).
- Leakly stories: published and sourced on this site, dated by leak date.