Ransomware attacks in October 2021

259 victims · 18 active groups · 4 new groups · 802 in September 2021 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 259 ransomware victims claimed on leak sites in October 2021, down 67.7% from 802 in September 2021.
18 groups posted at least one victim; the three most active groups, lockbit2 (100), conti (41) and spook (35), accounted for 68.0% of the total.
lockbit2 was the most active group with 100 victims, down from 171 in September 2021.
Manufacturing was the most-targeted sector with 49 victims (18.9% of the month's total), ahead of Business Services (40).
Organizations in the United States accounted for 3 victims (1.2%), followed by Italy (3) and Taiwan (2); 236 victims did not disclose a location.
4 groups appeared in HackerFeeds data for the first time this month, including bonacigroup, blackbyte and karma.

Daily activity

Busiest day: Oct 4 (43 victims). Quietest day: Oct 14 (0 victims). Victims were posted on 30 of 31 days.

Most active groups

#	Group	Victims	Share	September 2021	Change
1	lockbit2	100	38.6%	171	−71
2	conti	41	15.8%	42	−1
3	spook	35	13.5%	0	+35
4	pysa	27	10.4%	218	−191
5	blackbyte	18	6.9%	0	+18
6	karma	7	2.7%	0	+7
7	groove	6	2.3%	7	−1
8	revil	4	1.5%	24	−20
9	everest	3	1.2%	18	−15
10	dispossessor	3	1.2%	3	0
11	darkleakmarket	3	1.2%	27	−24
12	xinglocker	2	0.8%	0	+2
13	ragnarlocker	2	0.8%	3	−1
14	payloadbin	2	0.8%	23	−21
15	bonacigroup	2	0.8%	0	+2

Targeted sectors

#	Sector	Victims	Share of month
1	Manufacturing	49	18.9%
2	Business Services	40	15.4%
3	Technology	24	9.3%
4	Consumer Services	20	7.7%
5	Healthcare	16	6.2%
6	Agriculture and Food Production	14	5.4%
7	Construction	12	4.6%
8	Transportation/Logistics	11	4.2%
9	Public Sector	9	3.5%
10	Hospitality and Tourism	9	3.5%
11	Education	9	3.5%
12	Financial Services	8	3.1%

Countries

#	Country	Victims	Share of month
1	United States	3	1.2%
2	Italy	3	1.2%
3	Taiwan	2	0.8%
4	France	2	0.8%
5	Switzerland	2	0.8%
6	Venezuela	1	0.4%
7	Thailand	1	0.4%
8	Sweden	1	0.4%
9	Saudi Arabia	1	0.4%
10	Poland	1	0.4%
11	India	1	0.4%
12	Germany	1	0.4%
13	Brazil	1	0.4%
14	Australia	1	0.4%
15	Austria	1	0.4%

236 victims (91.1%) did not disclose a location.

Groups seen for the first time

Group	First victim
bonacigroup	Oct 4, 2021
blackbyte	Oct 4, 2021
karma	Oct 4, 2021
spook	Oct 4, 2021

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
Napili Kai Foundation Gallery	blackbyte	—	Oct 31, 2021
logcabinhomes.c...	lockbit2	—	Oct 31, 2021
LINICAL doesn't care about digital hygiene	ragnarlocker	—	Oct 30, 2021
logi-cv.com	lockbit2	—	Oct 30, 2021
Я не пью виски но с ним бы выпил	groove	—	Oct 30, 2021
Acorn Stairlifts	conti	—	Oct 29, 2021
Perrin	conti	—	Oct 29, 2021
ILLUM	conti	—	Oct 29, 2021
Major Wire Industries	conti	—	Oct 29, 2021
Los Gatos Tomato Products	conti	—	Oct 29, 2021
Marketing Alliance Group	conti	—	Oct 29, 2021
rijeka-airport....	lockbit2	—	Oct 29, 2021

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 259 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.