Ransomware attacks in September 2021

802 victims · 26 active groups · 11 new groups · 19 in August 2021 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 802 ransomware victims claimed on leak sites in September 2021, up 4121.1% from 19 in August 2021.
26 groups posted at least one victim; the three most active groups, pysa (218), lockbit2 (171) and avaddon (141), accounted for 66.1% of the total.
pysa was the most active group with 218 victims, after posting none in August 2021.
Manufacturing was the most-targeted sector with 130 victims (16.2% of the month's total), ahead of Business Services (111).
Organizations in Canada accounted for 9 victims (1.1%), followed by Australia (7) and the United States (6); 735 victims did not disclose a location.
11 groups appeared in HackerFeeds data for the first time this month, including blackmatter, alphv and arvinclub.

Daily activity

Busiest day: Sep 9 (553 victims). Quietest day: Sep 2 (0 victims). Victims were posted on 26 of 30 days.

Most active groups

#	Group	Victims	Share	August 2021	Change
1	pysa	218	27.2%	0	+218
2	lockbit2	171	21.3%	0	+171
3	avaddon	141	17.6%	0	+141
4	conti	42	5.2%	0	+42
5	darkleakmarket	27	3.4%	0	+27
6	blackmatter	26	3.2%	0	+26
7	revil	24	3.0%	0	+24
8	ransomexx	23	2.9%	1	+22
9	payloadbin	23	2.9%	0	+23
10	everest	18	2.2%	0	+18
11	mountlocker	16	2.0%	0	+16
12	suncrypt	10	1.2%	0	+10
13	nefilim	10	1.2%	0	+10
14	arvinclub	10	1.2%	0	+10
15	avoslocker	8	1.0%	8	0

Targeted sectors

#	Sector	Victims	Share of month
1	Manufacturing	130	16.2%
2	Business Services	111	13.8%
3	Technology	66	8.2%
4	Consumer Services	51	6.4%
5	Financial Services	47	5.9%
6	Healthcare	41	5.1%
7	Education	41	5.1%
8	Agriculture and Food Production	39	4.9%
9	Construction	36	4.5%
10	Transportation/Logistics	35	4.4%
11	Public Sector	30	3.7%
12	Energy	20	2.5%

Countries

#	Country	Victims	Share of month
1	Canada	9	1.1%
2	Australia	7	0.9%
3	United States	6	0.7%
4	Germany	6	0.7%
5	France	4	0.5%
6	Brazil	4	0.5%
7	Japan	3	0.4%
8	Italy	3	0.4%
9	South Africa	2	0.2%
10	Thailand	2	0.2%
11	Saudi Arabia	2	0.2%
12	Philippines	2	0.2%
13	United Kingdom	2	0.2%
14	Belgium	2	0.2%
15	Vietnam	1	0.1%

735 victims (91.6%) did not disclose a location.

Groups seen for the first time

Group	First victim
blackmatter	Sep 8, 2021
alphv	Sep 9, 2021
arvinclub	Sep 9, 2021
lockbit2	Sep 9, 2021
quantum	Sep 9, 2021
everest	Sep 9, 2021
hunters	Sep 9, 2021
lockdata	Sep 9, 2021
darkleakmarket	Sep 9, 2021
payloadbin	Sep 9, 2021
groove	Sep 9, 2021

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
Gershman Mortgage	conti	—	Sep 30, 2021
calautomotive.com	payloadbin	—	Sep 30, 2021
newhotel.com	lockbit2	—	Sep 30, 2021
fugybat.fr	lockbit2	FR	Sep 30, 2021
nitropiso.com.m...	lockbit2	—	Sep 30, 2021
texasacehvac.co...	lockbit2	—	Sep 30, 2021
transrendufense...	lockbit2	—	Sep 30, 2021
geda-produkte.d...	lockbit2	—	Sep 30, 2021
calsoft	payloadbin	—	Sep 30, 2021
Fimmick CRM Hong Kong (www.fimmick.com)	revil	—	Sep 30, 2021
calsoft.com	payloadbin	—	Sep 30, 2021
Fimmick CRM Honk Kong (www.fimmick.com)	revil	—	Sep 30, 2021

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 802 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.