Two Trackers Counted 2025 Leak-Site Victims and Disagreed by 151

One tracker recorded 7,458 victims named on dark-web leak sites during 2025, a 30% increase on 2024. Another recorded 7,307 companies listed, a 45% increase. A third analysis of the following period cites 8,159 and a 49% rise.

A 2% gap between 7,458 and 7,307 is unremarkable — different sites monitored, different handling of duplicates, different cut-off dates.

A gap between 30% and 45% growth is not. Those imply materially different 2024 baselines: roughly 5,740 against roughly 5,040. The disagreement is not about the year being reported. It is about the year before it, measured by the same organisations at the time.

Which means the headline that circulates — a percentage — is the least reliable figure in the set, because it compounds two independent measurement errors.

A leak-site listing is a publication decision by an attacker. Victims who pay before publication are generally never listed. Victims of groups that do not operate leak sites are never listed. Victims listed by two groups after a data resale are listed twice.

This desk has filed the point at 26-0425 and 26-0512, and it needs restating here because the number is now routinely reported as though it were an incident count. It is a count of advertisements.

The ecosystem file at 25-1226 records a record number of groups in 2025, and 25-1004 records a record number of active leak sites. More sites means more listings at any constant level of underlying activity.

Part of the rise this metric reports is therefore a direct artefact of the structural change it is being used to describe. It is not that the number is worthless — the direction is probably right, and the corpus has nothing better. It is that it should never be quoted to two significant figures.