When a ransomware group publishes a supplier’s files, the supplier’s customers are in them. We counted, once, on one publication.
What we found
99 of 104
In the files of one business-services supplier, published by a ransomware group in 2026, 99 of the 104 large groups on our list appear by their e-mail or web domain.
How we counted
The list: 104 organisations, drawn from the large French listed groups (CAC 40 and SBF 120) and from aerospace makers worldwide. Groups with a very short domain name were left out, because a short name can match another address.
A group counts when at least one record of the publication holds its domain: on its own, in an e-mail address, or in a sub-domain. Look-alike addresses do not count.
One publication, of one supplier. We name neither the supplier nor the groups.
Counted on 10 November 2026 in the OwlyScan index. A record is a part of a document, not a whole document.
What this does not say
It does not say these groups were attacked: the supplier was. It does not say how much there is about each group. And a wrong domain in our list could only lower the count.
The members of one aerospace cluster
We took the public member directory of a French aerospace cluster and searched every member company’s web domain, once.
283 of 648
283 of the 648 member companies with a website appear in at least one ransomware publication. None of them is in a publication under its own name: the files are someone else’s.
Half of them appear in 8 records or fewer, across 3 publications or fewer.
One in ten appears in more than 266 records.
SMEs: 217 of 499. Leading groups: 30 of 36.
Each dot is one company
Records
1101002001101001,00010,000
Publications
Horizontal: how many publications hold its domain. Vertical: how many records. Both scales are logarithmic. Dots with the same number of publications are spread slightly so they can be told apart. No company is named.
Companies by number of records
Records
Companies
Share
1
31
11%
2 to 9
119
42%
10 to 99
91
32%
100 to 999
28
10%
1,000 or more
14
5%
How we counted
The directory: every company in the cluster’s public member list on 10 November 2026; schools, laboratories, public bodies and investment funds were left out, and the 4 large groups listed under several entries were counted apart.
A company counts when at least one record holds its web domain, on its own or in an e-mail address. Company names were not used for this figure: a name can match something else.
A publication is one folder on a ransomware group’s site. The same breach can appear under two folders, so the horizontal scale is an upper bound.
“Under its own name” means the folder is named after the company or its domain.
What this does not say
It does not say these companies were attacked, nor what the records contain. It says their domain is written in files that a ransomware group took from another organisation and published.
