Open datasets

Three datasets from the ThreatCluster corpus, free to use with attribution: ransomware leak-site activity, CVE exploitation signals, and deduplicated security incidents. 100,711 rows in total.

Published because the raw material for security research is usually locked up, priced per seat, or scattered across sources that have to be stitched together first. These are the parts we can share.

Ransomware leak-site victims

Every victim listing collected first-hand from ransomware and extortion leak sites: which group named which organisation, when, and in what sector and country.

Rows

20,627

Fields

group, victim, sector, country, first observed, published, delisted state, position in that group’s history

Good for

Track which groups are active, how targeting shifts across sectors and countries, and how long listings stay up.

from datasets import load_dataset
ds = load_dataset("threatcluster/ransomware-leak-site-victims")

CVE exploitation signals

One row per CVE joining the reference data with the evidence that matters for triage: CISA KEV listing, public exploit availability and known ransomware use.

Rows

60,879

Fields

CVE id, description, CVSS score/severity/vector, CWEs, affected vendors and products, KEV dates, exploit count

Good for

Train or evaluate exploit-prediction models, or measure how severity scores relate to real exploitation.

from datasets import load_dataset
ds = load_dataset("threatcluster/cve-exploitation-signals")

Threat incident clusters

Security incidents as deduplicated stories rather than individual articles — one row per incident that at least two outlets reported.

Rows

19,205

Fields

title, prose summary, entities by type, reporting outlets, scores, urgency, date range, link back

Good for

Summarisation, event extraction and entity linking on real security reporting, with the outlets and entities already resolved.

from datasets import load_dataset
ds = load_dataset("threatcluster/threat-incident-clusters")

What is not in them

Being straight about the limits matters more than the row count:

• No victim screenshots or enriched records. Those can carry personal data, so the datasets hold the listing facts only.
• No source article text. Third-party copyright. You get our summaries and metadata, and links to the original reporting.
• No raw indicators. IPs, hashes and domains belong to the public IOC feed, not here.
• Nothing user-specific. No accounts, keys, queries or telemetry.

Read this before you use them

• Leak-site listings are claims, not confirmed breaches. They are evidence that a group posted a claim.
• Exploitation labels are observed, not exhaustive. Absence means "not known to us", never "not exploited", and both labels are time-dependent, so respect the publication date when splitting train and test data.
• Titles and summaries are model-generated and not human-verified.
• The threat score is a ranking signal, not a severity scale. Significant incidents routinely score in the 20s.

Each dataset card repeats these in full, with the per-field detail.

Ethical use

These datasets are published to support defensive security research, measurement and education. The organisations named in the ransomware data are the injured parties in criminal attacks. Do not use this data to target, harass or profile them.

Questions

Need it live rather than as a snapshot

These are periodic exports. The current corpus is queryable through the threat intelligence API with a free key, and the public feeds need no account at all.