Counting India on Ransomware Leak Sites

The first thing I noticed was how hard it was to answer a simple question: which of these ransomware victims are actually in India? The feeds have country tags. Some have .in domains. Company names contain “India”, “Bharat” and “Pvt Ltd”. There are addresses, city names and parent companies. On paper, it looks like enough to classify a list. It isn’t. Over twelve weeks, two ransomware leak-site aggregators produced 113 records that I eventually collapsed into 73 organisations in India. None of the underlying breach claims is verified. The 73 is not a breach count. It is the output of one set of classification and deduplication decisions applied to criminal claims.