What ransomware groups publish, by document type

What does “published” mean?

It usually happens in three steps. First, a claim: the group names the company on its own website. Next, sometimes, a sample shown as proof. Then, if the company does not pay, the files themselves, often as archives that anyone with the address can download.

A claim can be wrong or exaggerated: a group may name a company that was not attacked, or say it holds more than it does. OwlyScan indexes what was put online and does not tell you whether a claim is true.

What kinds of documents are in the files?

For each type, what it exposes and who it matters to.

• Contracts and quotes. Prices, terms, deadlines, signatures. They matter to the customers and suppliers whose terms are written there, and to competitors. A published insurance policy lists what the insurer would pay, line by line.
• Invoices and bank details. Who bought what, at what price, and the accounts that payments go to. They matter to the customers and suppliers named on them.
• HR files and identity documents. Employment contracts, pay slips, background checks, copies of passports and ID cards. They matter first to staff and applicants, who did not choose to be in them.
• E-mail archives. Messages and attachments: who negotiated what with whom. Sometimes the list of messages comes too, with sender, recipient and date, so a mailbox can be searched before any message is opened. They matter to anyone who wrote to the company.
• Technical drawings and specifications. CAD files, parts lists, wiring diagrams, machine and robot settings, often in the exchange formats sent to subcontractors. They matter to the company’s clients and competitors.
• Database exports. Customer lists, order histories, stock, sometimes as an export of an application left on a file share. They matter to the people and companies listed.
• Passwords and access details. Spreadsheets and text files named for what they hold, password-manager databases, VPN profiles, certificates with their private keys, connection settings. They matter to whoever owns the systems they open.
• Source code and settings. Most of what looks like code is other people’s libraries. What matters is the version history, the deployment settings and the in-house applications. They matter to the company and to the partners connected to its applications.
• Scans and photos. Delivery notes, signed pages. A scan can be named only by the date and time it was made, so its name tells you nothing. They matter to whoever signed them or appears on them.

Accounting and purchasing papers are a large part of what we see: ledgers, supplier invoices, purchase orders, price lists. Deleted files are published with the rest, recycle bin included, and files whose names carry a year from decades ago turn up in recent publications.

Who is named in them?

Mostly people and companies other than the victim. A contract has two parties, an invoice a customer, an e-mail a sender and a recipient, a pay slip an employee. The victim’s customers, suppliers and staff are named, though they were not attacked and are on no list.

We counted once, on one publication. In the files of one business-services supplier, published by a ransomware group in 2026, 99 of the 104 large groups on our list appear by their e-mail or web domain. The count dates from 10 November 2026. It is a case and not a rate, and it does not say those groups were attacked: the supplier was. How we counted.

If a company you work with was hit, read what to do when a supplier is hit by ransomware.

In what formats and languages?

The formats are those of an office: spreadsheets, PDF files, word-processing files, presentations, e-mail messages, images and database files. Spreadsheets are very common, and payroll, price lists, customer lists and stock are kept in them.

Files often come inside archives such as ZIP files, and sometimes archives inside archives. We open them, including the ones that hold other archives, and index what is inside. A publication can also be only a listing of folders and file names, which shows how a company is organised, not what its documents say. That is why a search of the text matters more than a file listing: a customer’s name is rarely in a file name.

What we index is not only in English: we find Spanish, German, French, Dutch, Italian, Japanese, Korean, Chinese, Polish and Turkish documents, among others. Search in the language of your company and its partners.

Why is the list of victims not enough?

A victim list tells you who was attacked, not who is inside the files. Your company is on it only if it was attacked, yet it can be named in a contract, an invoice or an e-mail of a company that was. A list is also made of claims, which can be wrong. To know whether you are in the files, search what they say.

How can you look for your own company?

Start with the free search. Type your company name as it appears on your invoices, then your domain. No account is needed. It tells you how many documents match and what kind they are, with names hidden; you do not read their text. How the free search works.

Access is a subscription for your company. It shows the records about your own domain as they are, keeps other companies’ names hidden, and connects your own AI assistant to the same data through MCP, a standard way to link an assistant to a data source. What Access gives you.

A search with no result is not proof that you are absent. A name can be spelled another way, a document can be missing from our index, and a group can publish later. Search again in a week or two.

Questions people ask