Ransomware attacks in January 2022
203 victims · 22 active groups · 2 new groups · 290 in December 2021 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 203 ransomware victims claimed on leak sites in January 2022, down 30.0% from 290 in December 2021.
- 22 groups posted at least one victim; the three most active groups, lockbit2 (48), vicesociety (34) and hive (32), accounted for 56.2% of the total.
- lockbit2 was the most active group with 48 victims, down from 62 in December 2021.
- Manufacturing was the most-targeted sector with 28 victims (13.8% of the month's total), ahead of Business Services (21).
- Organizations in the United States accounted for 10 victims (4.9%), followed by France (5) and Italy (4); 170 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: leaktheanalyst and nightsky.
Daily activity
Busiest day: Jan 25 (33 victims). Quietest day: Jan 2 (0 victims). Victims were posted on 29 of 31 days.
Most active groups
| # | Group | Victims | Share | December 2021 | Change |
|---|---|---|---|---|---|
| 1 | lockbit2 | 48 | 23.6% | 62 | −14 |
| 2 | vicesociety | 34 | 16.7% | 0 | +34 |
| 3 | hive | 32 | 15.8% | 23 | +9 |
| 4 | leaktheanalyst | 18 | 8.9% | 0 | +18 |
| 5 | alphv | 13 | 6.4% | 13 | 0 |
| 6 | conti | 11 | 5.4% | 36 | −25 |
| 7 | snatch | 9 | 4.4% | 13 | −4 |
| 8 | cuba | 8 | 3.9% | 6 | +2 |
| 9 | sabbath | 6 | 3.0% | 4 | +2 |
| 10 | everest | 5 | 2.5% | 5 | 0 |
| 11 | payloadbin | 3 | 1.5% | 1 | +2 |
| 12 | ragnarlocker | 2 | 1.0% | 5 | −3 |
| 13 | nightsky | 2 | 1.0% | 0 | +2 |
| 14 | midas | 2 | 1.0% | 3 | −1 |
| 15 | lockbit3 | 2 | 1.0% | 1 | +1 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 28 | 13.8% |
| 2 | Business Services | 21 | 10.3% |
| 3 | Education | 18 | 8.9% |
| 4 | Financial Services | 14 | 6.9% |
| 5 | Healthcare | 11 | 5.4% |
| 6 | Consumer Services | 11 | 5.4% |
| 7 | Public Sector | 8 | 3.9% |
| 8 | Construction | 8 | 3.9% |
| 9 | Transportation/Logistics | 6 | 3.0% |
| 10 | Hospitality and Tourism | 4 | 2.0% |
| 11 | Energy | 4 | 2.0% |
| 12 | Agriculture and Food Production | 4 | 2.0% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 10 | 4.9% |
| 2 | France | 5 | 2.5% |
| 3 | Italy | 4 | 2.0% |
| 4 | Germany | 4 | 2.0% |
| 5 | United Kingdom | 2 | 1.0% |
| 6 | Romania | 1 | 0.5% |
| 7 | Portugal | 1 | 0.5% |
| 8 | South Korea | 1 | 0.5% |
| 9 | India | 1 | 0.5% |
| 10 | Spain | 1 | 0.5% |
| 11 | Switzerland | 1 | 0.5% |
| 12 | Canada | 1 | 0.5% |
| 13 | United Arab Emirates | 1 | 0.5% |
170 victims (83.7%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| leaktheanalyst | Jan 1, 2022 |
| nightsky | Jan 4, 2022 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| paybito.com | lockbit3 | IN | Jan 31, 2022 |
| lhotellerie-restauration.fr | lv | FR | Jan 29, 2022 |
| themisautomation.com | alphv | — | Jan 29, 2022 |
| OilTanking GmbH and Mabanaft GmbH | alphv | DE | Jan 29, 2022 |
| KCA Deutag | ransomexx | — | Jan 28, 2022 |
| CIG de la Grande Couronne | midas | — | Jan 28, 2022 |
| Mab Group | snatch | AE | Jan 27, 2022 |
| elmonterv.com | lockbit2 | — | Jan 27, 2022 |
| Optionis | vicesociety | — | Jan 27, 2022 |
| Florida lawyer’s data leaked | everest | — | Jan 27, 2022 |
| estpm.fr | lockbit2 | FR | Jan 27, 2022 |
| girlguidinglase... | lockbit2 | — | Jan 27, 2022 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 203 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.