Ransomware attacks in March 2022

315 victims · 21 active groups · 2 new groups · 231 in February 2022 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 315 ransomware victims claimed on leak sites in March 2022, up 36.4% from 231 in February 2022.
21 groups posted at least one victim; the three most active groups, lockbit2 (136), conti (58) and hive (21), accounted for 68.3% of the total.
lockbit2 was the most active group with 136 victims, up from 95 in February 2022.
Manufacturing was the most-targeted sector with 59 victims (18.7% of the month's total), ahead of Business Services (51).
Organizations in Italy accounted for 7 victims (2.2%), followed by the United States (6) and Germany (5); 269 victims did not disclose a location.
2 groups appeared in HackerFeeds data for the first time this month: pandora and stormous.

Daily activity

Busiest day: Mar 17 (23 victims). Quietest day: Mar 5 (1 victims). Victims were posted on 31 of 31 days.

Most active groups

#	Group	Victims	Share	February 2022	Change
1	lockbit2	136	43.2%	95	+41
2	conti	58	18.4%	34	+24
3	hive	21	6.7%	23	−2
4	everest	18	5.7%	3	+15
5	alphv	16	5.1%	23	−7
6	vicesociety	9	2.9%	0	+9
7	stormous	8	2.5%	0	+8
8	blackbyte	8	2.5%	9	−1
9	pandora	5	1.6%	0	+5
10	snatch	4	1.3%	5	−1
11	ransomexx	4	1.3%	1	+3
12	midas	4	1.3%	6	−2
13	lorenz	4	1.3%	0	+4
14	lockbit3	4	1.3%	7	−3
15	cuba	4	1.3%	6	−2

Targeted sectors

#	Sector	Victims	Share of month
1	Manufacturing	59	18.7%
2	Business Services	51	16.2%
3	Healthcare	18	5.7%
4	Technology	17	5.4%
5	Public Sector	17	5.4%
6	Consumer Services	15	4.8%
7	Construction	14	4.4%
8	Financial Services	13	4.1%
9	Agriculture and Food Production	13	4.1%
10	Transportation/Logistics	11	3.5%
11	Energy	10	3.2%
12	Hospitality and Tourism	6	1.9%

Countries

#	Country	Victims	Share of month
1	Italy	7	2.2%
2	United States	6	1.9%
3	Germany	5	1.6%
4	Singapore	3	1.0%
5	France	3	1.0%
6	Switzerland	3	1.0%
7	India	2	0.6%
8	Colombia	2	0.6%
9	China	2	0.6%
10	Canada	2	0.6%
11	St. Vincent & Grenadines	1	0.3%
12	Tanzania	1	0.3%
13	Thailand	1	0.3%
14	Netherlands	1	0.3%
15	Japan	1	0.3%

269 victims (85.4%) did not disclose a location.

Groups seen for the first time

Group	First victim
pandora	Mar 17, 2022
stormous	Mar 22, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
Prima Sole Components Spa	conti	—	Mar 31, 2022
Rettenmeier Holding AG	conti	—	Mar 31, 2022
Parker Appliance Company	conti	—	Mar 31, 2022
SSW Consulting	alphv	—	Mar 31, 2022
Dober	alphv	—	Mar 31, 2022
studiobrazzale....	lockbit2	—	Mar 31, 2022
keypoint.com	lockbit2	—	Mar 31, 2022
yachtcharterfle...	lockbit2	—	Mar 31, 2022
bafokengholding...	lockbit2	—	Mar 31, 2022
Zeeland Farm Services, Inc.	conti	—	Mar 31, 2022
infotech ua	stormous	—	Mar 31, 2022
Yip in Tsoi	snatch	TH	Mar 31, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 315 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.