A leak site is where a ransomware group names organisations it claims to have attacked, typically used as pressure to pay up or face publication of stolen information.

What is double extortion?

Double extortion is when victims face both locked systems and the threat of their stolen information being exposed.

Can a VPN protect me from ransomware leak-site exposure?

Not much, for this particular threat; a VPN encrypts traffic between your device and the VPN server and masks your IP address, but leak-site exposure typically happens when an organisation's own systems are compromised.

New Ransomware Groups Drive 90% of Leak Site Claims

Q: What percentage of ransomware claims on leak sites come from new groups?

New groups are now responsible for more than 90 per cent of ransomware claims posted on leak sites.

Q: Does a leak-site listing prove exactly what data was stolen?

No, a listing is a claim, not proof of exactly what was taken, so it is worth treating it as a signal to check your own exposure rather than assuming the worst.

The number of organisations listed on darknet leak sites has risen, and according to reporting from Cyber Daily, new groups are now responsible for more than 90 per cent of ransomware claims. The trend around new ransomware groups leak sites is worth understanding even if you never run a company network, because the data posted on those sites often belongs to ordinary customers, patients and employees.

This post covers what the finding suggests, what it means for personal data, where a VPN fits (and where it does not), and the practical steps that help.

Why new ransomware groups keep multiplying

The headline figure is that newer groups, not long-established ones, account for the overwhelming majority of claims posted on leak sites. In other words, the ransomware scene is not dominated by a small set of veteran names. It is a constantly refreshed field of newcomers, and each one publishes its own list of alleged victims.

The source article's summary does not spell out every reason behind this churn, so it would be a mistake to over-explain it here. What the data does show is that the ecosystem is fragmented. When claims are spread across many fresh groups, defenders have a harder time tracking behaviour, and the names on leak sites change quickly. Even long-running operations remain a factor; our coverage of the LockBit 5.0 double extortion campaign shows that established brands are still active alongside the newcomers.

For readers, the key point is simple: there is no single group to watch out for. The risk is broad, and it does not depend on any one brand name.

What leak-site listings mean for your personal data

A leak site is where a ransomware group names organisations it claims to have attacked. Typically the listing is used as pressure: pay up, or the stolen information may be published. That tactic is often called double extortion, because victims face both locked systems and the threat of exposure.

If an organisation you deal with ends up on one of these sites, the information at stake could include whatever that organisation holds about you. Depending on the company, that might be contact details, account information or other records. A listing is a claim, not proof of exactly what was taken, so it is worth treating it as a signal to check your own exposure rather than assuming the worst.

With more groups posting more claims, the odds rise that at some point one of the organisations holding your data appears on a list. You cannot control that directly. You can control how much damage a leak does to you personally.

What a VPN can and can't do against ransomware

It is natural to wonder whether a VPN helps here. The honest answer is: not much, for this particular threat.

A VPN encrypts traffic between your device and the VPN server and masks your IP address from sites you visit. That is useful on public Wi-Fi and for limiting some tracking. But ransomware leak-site exposure typically happens when an organisation's own systems are compromised. Your VPN has no say in how a retailer, clinic or employer protects its servers, and it cannot pull your data back once it sits in a stolen archive.

A VPN also does not stop you from opening a malicious attachment or reusing a password that later appears in a dump. Think of it as one privacy tool among several, not a defence against ransomware or its aftermath.

Practical steps to reduce your exposure

The most effective measures are unglamorous, and they work whichever group happens to be in the news.

Use unique passwords everywhere. A password manager makes this realistic. If one organisation is breached, reused credentials will not unlock your other accounts.
Turn on multi-factor authentication (MFA). Prefer an authenticator app or hardware key over SMS where you can. MFA limits what a stolen password can do.
Keep tested backups. Maintain at least one copy of important files that is disconnected from your main device or stored offline, and check that you can actually restore from it.
Share less data. Data minimisation matters: if a company does not hold your date of birth or ID number, it cannot leak them. Skip optional fields and delete old accounts you no longer use.
Update software promptly. Operating system and app updates close holes that attackers use to get in.
Be wary after a notification. If an organisation tells you it was affected, change that account's password, watch for suspicious emails or calls, and be cautious with anything that references details only that company would know.

What This Means For You

The shift toward a crowded field of new ransomware groups means leak-site listings are likely to keep coming, and you will not always know which organisations are affected until after the fact. Your best strategy is to assume that some of your data may eventually be exposed and to make that exposure as harmless as possible. Strong, unique credentials, MFA and sensible data sharing do far more than any single privacy tool.

Key takeaways

The finding that new groups drive more than 90 per cent of claims shows how widespread the problem has become. Do not wait for a breach notice to act. Tighten your account security today: set up a password manager, enable MFA on email, banking and cloud accounts, back up your important files, and clear out accounts you no longer need. To see how leak-site pressure plays out in a real, ongoing campaign, read our report on LockBit 5.0 and double extortion. Understanding the tactic is the first step toward blunting it, and new ransomware groups leak sites will matter less to you if your accounts are well protected.