How we count in an ecosystem study

Version of 13 November 2026.

Every ecosystem study follows the rules below. They are the same for every sector.

OwlyScan indexes the files that ransomware groups and forums publish. The index holds more than 160 million passages. A passage is a piece of a document.

We read what is published.

What counts as a match

A match is a passage that holds the exact name of a company and one term of the scenario. The terms are fixed before the count and listed in each study.

A match is two strings in one passage. It is not proof that a given document was published.

How we compare

Raw counts follow size: a company named everywhere is named near every word. So we compare rates. We run the same search on ten large companies outside the sector and take them as 1. The comparison companies are chosen before the count: ten large French companies in food, retail and pharmaceuticals.

Publications and batches

The index groups passages by collection batch: one run of our crawlers on one source. A batch is usually close to one publication, and one publication can be split over several batches. So publication counts are estimates.

How suppliers are chosen

Suppliers come from a public list of the sector, named in each study. We pick names that are distinctive, and we leave out three kinds of names: names with other meanings, very large groups that sell to many industries, and companies owned by one of the big companies.

A supplier is linked to the big company it shares the most passages with. That is a count of shared passages, not a contract.

Why big companies are shown "with their suppliers"

A passage that names a big company can come from anyone’s files: a supplier, a contractor, a customer or the company itself. Our counts do not tell them apart. So a study never speaks of a big company alone.

Why suppliers are not named, and why we give no raw counts

A count is not a proof, and a study is not an accusation. We show a supplier’s activity, its region and its closest big company. We give ratios and shares, not raw counts, because the index changes every day.

Only the company itself should look further. The free search lets it do that.

What the figures cannot tell you

  • Who downloaded published files. Nobody can see that.
  • Whether a named company was breached. Being named does not mean it.
  • What is written in other languages or other words than the terms we searched.
  • The whole sector. A study covers a few dozen names out of thousands.

Updates

Each page shows the month of its count.