All datasets › Crime
Ransomware in the News 2019–2026: article-level dataset and coverage tables
A dataset of ransomware news from a global news index, January 2019 – July 2026, built with the Prism News API (historical and real-time news, https://radar-api.fliarbi.com/news). Every row is one news article about ransomware, with its date, location, tone, editorial priority, themes and the organisations it names, plus a link that returns the full article through the API.
Download
Data-platform copies are being published; links appear here as they go live.
Key findings
In a global news index covering January 2019 to July 2026, ransomware's share of news coverage rose from 1.89 articles per 10,000 news articles in 2019 to 5.77 in 2021, a 3.05-fold increase, and then fell to 2.44 per 10,000 in 2025, 57.7% below the 2021 level.
Basis: Annual ransomware articles divided by all articles in the index for the same year, 2019–2025 (47,662 matched articles in the full window).
May 2021, the month of the Colonial Pipeline ransomware attack, was the month in which ransomware took its largest share of global news between January 2019 and July 2026, at 12.52 articles per 10,000 news articles, and May, July and June 2021 were the three highest months of the period.
Basis: Monthly ransomware articles per 10,000 news articles, every month from January 2019 to July 2026 (12.52, 10.04 and 9.51 in May, July and June 2021).
Of ransomware articles carrying a tone label between January 2023 and July 2026, 77.6% were negative in tone, 2.31 times the 33.6% negative share across all news in the same index.
Basis: Top sentiment label of each article, grouped into negative, neutral and positive; 99.8% of sampled articles carry a label.
Model-assigned priority ratings placed 90.9% of ransomware articles at critical priority (7 or higher on a 1–9 scale) between January 2023 and July 2026, 2.13 times the 42.6% share for all news.
Basis: Top priority label per article; critical = priority ≥ 7.
Data recovery and backup appeared as a theme in 2.65% of themed ransomware articles between January 2023 and July 2026, 338.7 times its frequency in all themed news.
Basis: Theme labels assigned to each article; lift against all themed news.
Charts and maps
Coverage by country
Primary location of located articles, January 2023 – July 2026. Lift = the country's share of this topic's news ÷ its share of all located news (above 1 = over-covered).
| Country | Articles | Share | Lift |
|---|---|---|---|
| United States | 4,721 | 47.81% | 0.99 |
| United Kingdom | 1,295 | 13.11% | 2.25 |
| India | 574 | 5.81% | 0.44 |
| Russia | 300 | 3.04% | 4.03 |
| Australia | 266 | 2.69% | 1.26 |
| Singapore | 247 | 2.5% | 2.81 |
| Canada | 193 | 1.95% | 0.91 |
| Japan | 184 | 1.86% | 1.75 |
| Ukraine | 175 | 1.77% | 3.3 |
| China | 164 | 1.66% | 0.63 |
| France | 121 | 1.23% | 0.62 |
| Germany | 110 | 1.11% | 0.95 |
| New Zealand | 102 | 1.03% | 1.6 |
Use the API
This dataset was built with the Prism News API, which serves historical and real-time news. Install the command-line client, log in with an API key, and query the topic yourself:
curl -fsSL https://raw.githubusercontent.com/fliarbi/prism-news-api/main/scripts/install.sh | bash
prism-news login
prism-news trends "ransomware" --granularity monthly --tableCite
Fliar BI. Ransomware in the News 2019–2026: article-level dataset and coverage tables. January 2019 – July 2026. https://fliarbi.github.io/news-datasets/ransomware/