Ransomware attacks in November 2021
300 victims · 18 active groups · 5 new groups · 259 in October 2021 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 300 ransomware victims claimed on leak sites in November 2021, up 15.8% from 259 in October 2021.
- 18 groups posted at least one victim; the three most active groups, lockbit2 (96), pysa (59) and conti (54), accounted for 69.7% of the total.
- lockbit2 was the most active group with 96 victims, down from 100 in October 2021.
- Business Services was the most-targeted sector with 52 victims (17.3% of the month's total), ahead of Manufacturing (44).
- Organizations in the United States accounted for 11 victims (3.7%), followed by Japan (3) and Mexico (2); 265 victims did not disclose a location.
- 5 groups appeared in HackerFeeds data for the first time this month, including medusalocker, lv and sabbath.
Daily activity
Busiest day: Nov 8 (63 victims). Quietest day: Nov 14 (0 victims). Victims were posted on 29 of 30 days.
Most active groups
| # | Group | Victims | Share | October 2021 | Change |
|---|---|---|---|---|---|
| 1 | lockbit2 | 96 | 32.0% | 100 | −4 |
| 2 | pysa | 59 | 19.7% | 27 | +32 |
| 3 | conti | 54 | 18.0% | 41 | +13 |
| 4 | midas | 25 | 8.3% | 0 | +25 |
| 5 | blackbyte | 13 | 4.3% | 18 | −5 |
| 6 | snatch | 12 | 4.0% | 0 | +12 |
| 7 | everest | 9 | 3.0% | 3 | +6 |
| 8 | sabbath | 6 | 2.0% | 0 | +6 |
| 9 | lv | 6 | 2.0% | 0 | +6 |
| 10 | blackmatter | 5 | 1.7% | 1 | +4 |
| 11 | suncrypt | 4 | 1.3% | 0 | +4 |
| 12 | quantum | 4 | 1.3% | 0 | +4 |
| 13 | dispossessor | 2 | 0.7% | 3 | −1 |
| 14 | ransomexx | 1 | 0.3% | 1 | 0 |
| 15 | ragnarlocker | 1 | 0.3% | 2 | −1 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 52 | 17.3% |
| 2 | Manufacturing | 44 | 14.7% |
| 3 | Consumer Services | 23 | 7.7% |
| 4 | Technology | 16 | 5.3% |
| 5 | Healthcare | 15 | 5.0% |
| 6 | Public Sector | 14 | 4.7% |
| 7 | Financial Services | 14 | 4.7% |
| 8 | Construction | 13 | 4.3% |
| 9 | Agriculture and Food Production | 13 | 4.3% |
| 10 | Education | 12 | 4.0% |
| 11 | Transportation/Logistics | 11 | 3.7% |
| 12 | Energy | 10 | 3.3% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 11 | 3.7% |
| 2 | Japan | 3 | 1.0% |
| 3 | Mexico | 2 | 0.7% |
| 4 | Italy | 2 | 0.7% |
| 5 | United Kingdom | 2 | 0.7% |
| 6 | Germany | 2 | 0.7% |
| 7 | Canada | 2 | 0.7% |
| 8 | Turkey | 1 | 0.3% |
| 9 | Singapore | 1 | 0.3% |
| 10 | Sweden | 1 | 0.3% |
| 11 | Peru | 1 | 0.3% |
| 12 | Netherlands | 1 | 0.3% |
| 13 | Indonesia | 1 | 0.3% |
| 14 | France | 1 | 0.3% |
| 15 | Colombia | 1 | 0.3% |
265 victims (88.3%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| medusalocker | Nov 3, 2021 |
| lv | Nov 22, 2021 |
| sabbath | Nov 22, 2021 |
| snatch | Nov 29, 2021 |
| midas | Nov 29, 2021 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| kenwal.com | lockbit2 | — | Nov 30, 2021 |
| Volvo Car Corporation | snatch | SE | Nov 30, 2021 |
| QRS Healthcare Solutions | snatch | US | Nov 30, 2021 |
| UABL S.A. | quantum | — | Nov 30, 2021 |
| Read more | suncrypt | — | Nov 30, 2021 |
| Burda Sanitärtechnik | conti | — | Nov 30, 2021 |
| Karges-Faulconbridge, Inc. | blackbyte | — | Nov 30, 2021 |
| MOTOR VEHICLE ACCIDENT FUND PENSION FUND | blackbyte | — | Nov 30, 2021 |
| Koltepatil | blackbyte | — | Nov 30, 2021 |
| SIRCHIE | conti | — | Nov 29, 2021 |
| totalfire.biz | lockbit2 | — | Nov 29, 2021 |
| callay.com.tr | lockbit2 | TR | Nov 29, 2021 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 300 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.