---
title: "Sector victims"
method: GET
path: "/ransomware/sector-victims"
tags: ["ransomware"]
---

# Sector victims

`GET /ransomware/sector-victims`

Drill-down for one sector: `{sector, name, riskLevel, attacksThisMonth,
attacksThisYear, totalKnown, recentVictims[], topGroups[{name, count,
description, firstSeen, lastSeen, victimCount, countries, tools}]}`.
`recentVictims` are the raw cached victim documents, newest claim first.
Costs one request of the monthly quota.

## Query parameters

- `sector` string

## Response `200`

`{sector, name, riskLevel, attacksThisMonth, attacksThisYear, totalKnown, recentVictims[], topGroups[]}`

- object

## Other responses

- `400` — Missing `sector`
- `401` — Unauthorized - Missing or invalid API key
- `404` — No victims cached for this sector
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/ransomware/sector-victims/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)