HackerFeeds
All monthly reports

Ransomware attacks in December 2021

290 victims · 32 active groups · 11 new groups · 300 in November 2021 · Updated Oct 14, 2026

Key findings

  • HackerFeeds recorded 290 ransomware victims claimed on leak sites in December 2021, down 3.3% from 300 in November 2021.
  • 32 groups posted at least one victim; the three most active groups, lockbit2 (62), conti (36) and marketo (31), accounted for 44.5% of the total.
  • lockbit2 was the most active group with 62 victims, down from 96 in November 2021.
  • Business Services was the most-targeted sector with 49 victims (16.9% of the month's total), ahead of Manufacturing (48).
  • Organizations in the United States accounted for 11 victims (3.8%), followed by India (7) and France (6); 238 victims did not disclose a location.
  • 11 groups appeared in HackerFeeds data for the first time this month, including robinhood, rook and marketo.

Daily activity

Busiest day: Dec 18 (57 victims). Quietest day: Dec 17 (0 victims). Victims were posted on 29 of 31 days.

Most active groups

#GroupVictimsShareNovember 2021Change
1lockbit2
62
21.4%96−34
2conti
36
12.4%54−18
3marketo
31
10.7%0+31
4hive
23
7.9%0+23
5mosesstaff
16
5.5%0+16
6snatch
13
4.5%12+1
7alphv
13
4.5%0+13
8lv
11
3.8%6+5
9cryp70n1c0d3
11
3.8%0+11
10rook
8
2.8%0+8
11quantum
7
2.4%4+3
12cuba
6
2.1%0+6
13blackbyte
6
2.1%13−7
14ragnarlocker
5
1.7%1+4
15everest
5
1.7%9−4

Targeted sectors

#SectorVictimsShare of month
1Business Services49
16.9%
2Manufacturing48
16.6%
3Technology42
14.5%
4Consumer Services26
9.0%
5Financial Services14
4.8%
6Healthcare13
4.5%
7Public Sector12
4.1%
8Transportation/Logistics9
3.1%
9Hospitality and Tourism9
3.1%
10Energy6
2.1%
11Education6
2.1%
12Agriculture and Food Production6
2.1%

Countries

#CountryVictimsShare of month
1United States11
3.8%
2India7
2.4%
3France6
2.1%
4Brazil4
1.4%
5Italy3
1.0%
6Canada3
1.0%
7Thailand2
0.7%
8Malaysia2
0.7%
9Japan2
0.7%
10United Kingdom2
0.7%
11Germany2
0.7%
12Turkey1
0.3%
13Poland1
0.3%
14Norway1
0.3%
15Netherlands1
0.3%

238 victims (82.1%) did not disclose a location.

Groups seen for the first time

GroupFirst victim
robinhoodDec 6, 2021
rookDec 7, 2021
marketoDec 7, 2021
lapsus$Dec 10, 2021
cryp70n1c0d3Dec 18, 2021
blackshadowDec 18, 2021
mosesstaffDec 18, 2021
fogDec 20, 2021
atomsiloDec 21, 2021
lockbit3Dec 26, 2021
blacktorDec 30, 2021

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

VictimGroupCountryDate
wagstaff.com - 1.5TB LEAKEDlv—Dec 31, 2021
Chattanooga Chamber of Commercequantum—Dec 31, 2021
lee-associates....lockbit2 USDec 31, 2021
Centaris.comalphv—Dec 30, 2021
independentprin...lockbit2—Dec 30, 2021
https://www.lee...lockbit2—Dec 30, 2021
rightsys.comlockbit2—Dec 30, 2021
grupomakler.comlockbit2—Dec 30, 2021
New City Commercial Corporation (NCCC)alphv—Dec 30, 2021
van Eupen Logistikalphv—Dec 30, 2021
Buffers USAalphv—Dec 30, 2021
Hunter Douglas | hunterdouglas.com.aualphv—Dec 30, 2021

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 290 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.