Days, not hours
Leak sites often list victims days before customers are told.
Ransomware early warning · Supplier exposure · Compliance clocks
Know when ransomware touches your business — or your suppliers — first.
We watch ransomware leak sites and threat feeds around the clock, match every new victim to your company and vendors, and start your regulatory clock the moment one matches.
- Financial services
- Healthcare
- Manufacturing
- Example points · fictional
Offsys Intel coverage
- live feeds & leak sites
- 50+
- ransomware groups tracked
- 470+
- victims indexed since 2021
- 19,000+
- indicators of compromise
- 1.1M+
Platform figures, updated continuously.
The problem
The leak site posts it before anyone tells you.
6 hours
CERT-In expects certain incidents reported within six hours of noticing them.
Source: CERT-In Directions, 28 April 2022 ↗Your vendors are your attack surface
Payroll, IT support, law firms, SaaS. Their breach can expose your data.
Offsys Intel watches the leak sites, matches every victim to your vendor list, and tells you first, with the deadline already running. See how it works →
Summaries, not legal advice. Confirm obligations with your counsel.
How it works
From leak-site post to action, in four steps.
Sample at this stage · fictional
source leak site (Tor mirror) seen 02:09 IST group LOCKBYTE post "northwind payroll svcs - 212 GB - 6 days"Sample at this stage · fictional
victim Northwind Payroll Services aka NORTHWIND PAYROLL SVCS sector Business services · payroll country India size est. 200–500 staff
Sample at this stage · fictional
watchlist vendors / payroll entry "Northwind Payroll Services Pvt Ltd" match name + domain result WATCHLIST MATCHSample at this stage · fictional
alert Slack #sec-alerts · email sent 02:14 IST clocks CERT-In 6 h · NIS2 24 h next Incident Flash briefing
Compliance Clock
The clock starts when you become aware. We make sure that's early.
When a watchlist match fires, we calculate each deadline and keep the evidence trail for your report.
How the Compliance Clock works →Example · fictional match at 02:14 IST
--:--:--remaining
--:--:--remaining
--:--:--remaining
Demo at 600× speed. Amber under 25% left, red under 10%.
SEC runs from the materiality determination; the demo counts business days as 24 h. Not legal advice.
Actionable briefings
Not another newsletter. A Monday-morning to-do list.
- 1What changedNew victims in your sector and supply chain.
- 2What's next LabsGangs shifting toward your sector.
- 3Do thisCVEs to patch, IOCs to block, vendors to check, rules to deploy.
Offsys Intel BriefingsSample · fictional data
Weekly Outlook
Reviewed by an analyst before sending
Your exposure this week
- Northwind Payroll Services · supplierLOCKBYTE · Tue
- 2 new victims in your sector, IndiaMon, Thu
Threat movement Labs
One tracked group listed more Indian financial-services victims this month than in the previous three combined.
Do this
- Patch CVE-XXXX-XXXX on internet-facing VPN appliances.Infra lead · Fri
- Block the 14 IOCs in the attached STIX bundle.SOC · today
- Ask Northwind Payroll whether your employee data was in scope.Vendor risk · Wed
- Deploy Sigma rule “Suspicious VSS deletion”.Detection eng · Fri
Labs · early accessOffsys Signals
From what happened to what's likely next.
Forecasts built on 5 years of leak-site history: sector outlooks, gang targeting shifts, leak-to-dump countdowns. Every forecast has a range. We'll publish a public scorecard of how they did, starting January 2027.
Weekly victims in one sector, with a 4-week outlook
Fictional exampleWho it's for
For the people who answer when a supplier is breached.
Regulated companiesYour vendor's breach is your reporting problem.Company and supplier watchlists, with the reporting clock running from the first match.For CISOs, risk and compliance →MSSPs & vCISOsGive every client a dark-web early-warning service without building one.One feed and briefings for your clients. Multi-client workspaces are on the roadmap; pilot partners welcome.For service providers →Insurers & brokersKnow which insured companies were just listed, and which sectors are heating up.Portfolio watchlists, sector trends and historical victim data by API.For underwriting and portfolio teams →SOC & threat-intel teamsEnriched, deduplicated intel straight into Splunk, Elastic or Sentinel.IOCs mapped to MITRE ATT&CK, STIX/TAXII, hunting and graph tools.For analysts and detection engineers →
Sends to the tools you already run
- Splunk HEC
- Elastic
- Microsoft Sentinel
- STIX 2.1 / TAXII 2.1
- MISP
- Slack
- Telegram
- REST API
Trust
Collected responsibly. Explained clearly.
- We collect leak-site metadata, never trade in stolen data.Victim, date, group and claim. We don't download, buy or sell stolen files.
- Every alert links to its evidence.Where it was listed, when we saw it, when we told you.
- MFA, role-based access and audit logs on every account.TOTP sign-in, admin / analyst / read-only roles, API keys and audit logging.
Free exposure check
Find out what the leak sites already know about your suppliers.
Send your company and up to 10 vendors. We'll check them against every leak site we track.