Ransomware attacks in February 2022
231 victims · 20 active groups · 0 new groups · 203 in January 2022 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 231 ransomware victims claimed on leak sites in February 2022, up 13.8% from 203 in January 2022.
- 20 groups posted at least one victim; the three most active groups, lockbit2 (95), conti (34) and hive (23), accounted for 65.8% of the total.
- lockbit2 was the most active group with 95 victims, up from 48 in January 2022.
- Manufacturing was the most-targeted sector with 41 victims (17.7% of the month's total), ahead of Business Services (32).
- Organizations in the United States accounted for 13 victims (5.6%), followed by Italy (6) and Mexico (3); 177 victims did not disclose a location.
- No groups appeared in HackerFeeds data for the first time this month.
Daily activity
Busiest day: Feb 25 (35 victims). Quietest day: Feb 10 (1 victims). Victims were posted on 28 of 28 days.
Most active groups
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 41 | 17.7% |
| 2 | Business Services | 32 | 13.9% |
| 3 | Consumer Services | 21 | 9.1% |
| 4 | Technology | 13 | 5.6% |
| 5 | Education | 11 | 4.8% |
| 6 | Healthcare | 10 | 4.3% |
| 7 | Transportation/Logistics | 9 | 3.9% |
| 8 | Construction | 9 | 3.9% |
| 9 | Financial Services | 8 | 3.5% |
| 10 | Hospitality and Tourism | 7 | 3.0% |
| 11 | Agriculture and Food Production | 7 | 3.0% |
| 12 | Telecommunication | 4 | 1.7% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 13 | 5.6% |
| 2 | Italy | 6 | 2.6% |
| 3 | Mexico | 3 | 1.3% |
| 4 | Brazil | 3 | 1.3% |
| 5 | Belgium | 3 | 1.3% |
| 6 | India | 2 | 0.9% |
| 7 | United Kingdom | 2 | 0.9% |
| 8 | Germany | 2 | 0.9% |
| 9 | Australia | 2 | 0.9% |
| 10 | Turkey | 1 | 0.4% |
| 11 | Thailand | 1 | 0.4% |
| 12 | Romania | 1 | 0.4% |
| 13 | Portugal | 1 | 0.4% |
| 14 | Netherlands | 1 | 0.4% |
| 15 | Kuwait | 1 | 0.4% |
177 victims (76.6%) did not disclose a location.
Groups seen for the first time
No groups appeared in HackerFeeds data for the first time this month.
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| InfoTek Consulting Services | quantum | CA | Feb 28, 2022 |
| ccli | lockbit2 | — | Feb 28, 2022 |
| aria-label=Google> | sabbath | — | Feb 28, 2022 |
| GHI Hornos Industriales first batch of Data (0,1%) | ragnarlocker | — | Feb 28, 2022 |
| safed.in | lockbit2 | IN | Feb 28, 2022 |
| jamailsmith.com | lockbit2 | — | Feb 28, 2022 |
| lakeview.com | lockbit2 | — | Feb 27, 2022 |
| richmondmonroe.... | lockbit2 | — | Feb 27, 2022 |
| us.jll.com | lockbit2 | — | Feb 27, 2022 |
| ugcorp.com | lockbit2 | — | Feb 27, 2022 |
| WARNING | lockbit2 | — | Feb 27, 2022 |
| cgm | lockbit2 | — | Feb 27, 2022 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 231 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.