Ransomware attacks in April 2022

328 victims · 25 active groups · 5 new groups · 315 in March 2022 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 328 ransomware victims claimed on leak sites in April 2022, up 4.1% from 315 in March 2022.
25 groups posted at least one victim; the three most active groups, lockbit2 (131), conti (38) and alphv (27), accounted for 59.8% of the total.
lockbit2 was the most active group with 131 victims, down from 136 in March 2022.
Manufacturing was the most-targeted sector with 52 victims (15.9% of the month's total), ahead of Business Services (50).
Organizations in the United States accounted for 13 victims (4.0%), followed by France (4) and Germany (4); 277 victims did not disclose a location.
5 groups appeared in HackerFeeds data for the first time this month, including kelvinsecurity, 8base and cryptbb.

Daily activity

Busiest day: Apr 29 (28 victims). Quietest day: Apr 16 (2 victims). Victims were posted on 30 of 30 days.

Most active groups

#	Group	Victims	Share	March 2022	Change
1	lockbit2	131	39.9%	136	−5
2	conti	38	11.6%	58	−20
3	alphv	27	8.2%	16	+11
4	kelvinsecurity	18	5.5%	0	+18
5	vicesociety	17	5.2%	9	+8
6	quantum	15	4.6%	0	+15
7	blackbasta	12	3.7%	0	+12
8	stormous	9	2.7%	8	+1
9	onyx	7	2.1%	0	+7
10	darkleakmarket	7	2.1%	0	+7
11	lorenz	6	1.8%	4	+2
12	revil	5	1.5%	0	+5
13	hive	5	1.5%	21	−16
14	everest	5	1.5%	18	−13
15	suncrypt	4	1.2%	3	+1

Targeted sectors

#	Sector	Victims	Share of month
1	Manufacturing	52	15.9%
2	Business Services	50	15.2%
3	Consumer Services	24	7.3%
4	Construction	23	7.0%
5	Public Sector	20	6.1%
6	Financial Services	18	5.5%
7	Technology	17	5.2%
8	Healthcare	16	4.9%
9	Agriculture and Food Production	14	4.3%
10	Education	12	3.7%
11	Transportation/Logistics	7	2.1%
12	Energy	7	2.1%

Countries

#	Country	Victims	Share of month
1	United States	13	4.0%
2	France	4	1.2%
3	Germany	4	1.2%
4	Italy	3	0.9%
5	Canada	3	0.9%
6	Spain	2	0.6%
7	Switzerland	2	0.6%
8	Australia	2	0.6%
9	Austria	2	0.6%
10	Argentina	2	0.6%
11	United Arab Emirates	2	0.6%
12	Thailand	1	0.3%
13	Sweden	1	0.3%
14	Qatar	1	0.3%
15	Peru	1	0.3%

277 victims (84.5%) did not disclose a location.

Groups seen for the first time

Group	First victim
kelvinsecurity	Apr 1, 2022
8base	Apr 3, 2022
cryptbb	Apr 3, 2022
blackbasta	Apr 26, 2022
onyx	Apr 29, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
sagefruit.com	lockbit2	—	Apr 30, 2022
p	lockbit2	—	Apr 30, 2022
hispanoamerican...	lockbit2	—	Apr 30, 2022
7generations.or...	lockbit2	—	Apr 30, 2022
w	lockbit2	—	Apr 30, 2022
Valley Rentals	quantum	NL	Apr 29, 2022
Hufcor	quantum	US	Apr 29, 2022
Grosvenor Engineering Group	quantum	AU	Apr 29, 2022
Drive Products	quantum	CA	Apr 29, 2022
Petro Serve	quantum	QA	Apr 29, 2022
Henry	quantum	US	Apr 29, 2022
brid	lockbit2	—	Apr 29, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 328 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.