Ransomware attacks in May 2022

251 victims · 23 active groups · 2 new groups · 328 in April 2022 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 251 ransomware victims claimed on leak sites in May 2022, down 23.5% from 328 in April 2022.
23 groups posted at least one victim; the three most active groups, lockbit2 (99), conti (18) and blackbasta (18), accounted for 53.8% of the total.
lockbit2 was the most active group with 99 victims, down from 131 in April 2022.
Manufacturing was the most-targeted sector with 35 victims (13.9% of the month's total), ahead of Business Services (33).
Organizations in the United States accounted for 13 victims (5.2%), followed by Italy (4) and Germany (4); 192 victims did not disclose a location.
2 groups appeared in HackerFeeds data for the first time this month: mindware and cheers.

Daily activity

Busiest day: May 5 (19 victims). Quietest day: May 8 (0 victims). Victims were posted on 30 of 31 days.

Most active groups

#	Group	Victims	Share	April 2022	Change
1	lockbit2	99	39.4%	131	−32
2	conti	18	7.2%	38	−20
3	blackbasta	18	7.2%	12	+6
4	alphv	18	7.2%	27	−9
5	hive	17	6.8%	5	+12
6	mindware	13	5.2%	0	+13
7	vicesociety	10	4.0%	17	−7
8	kelvinsecurity	8	3.2%	18	−10
9	blackbyte	8	3.2%	0	+8
10	quantum	7	2.8%	15	−8
11	lorenz	7	2.8%	6	+1
12	ransomhouse	4	1.6%	0	+4
13	cheers	4	1.6%	0	+4
14	everest	3	1.2%	5	−2
15	8base	3	1.2%	3	0

Targeted sectors

#	Sector	Victims	Share of month
1	Manufacturing	35	13.9%
2	Business Services	33	13.1%
3	Technology	19	7.6%
4	Consumer Services	19	7.6%
5	Healthcare	14	5.6%
6	Transportation/Logistics	13	5.2%
7	Agriculture and Food Production	12	4.8%
8	Public Sector	11	4.4%
9	Financial Services	10	4.0%
10	Energy	9	3.6%
11	Education	9	3.6%
12	Construction	8	3.2%

Countries

#	Country	Victims	Share of month
1	United States	13	5.2%
2	Italy	4	1.6%
3	Germany	4	1.6%
4	Australia	4	1.6%
5	United Kingdom	3	1.2%
6	Canada	3	1.2%
7	Austria	3	1.2%
8	Taiwan	2	0.8%
9	Portugal	2	0.8%
10	Mexico	2	0.8%
11	Japan	2	0.8%
12	France	2	0.8%
13	China	2	0.8%
14	Brazil	2	0.8%
15	Poland	1	0.4%

192 victims (76.5%) did not disclose a location.

Groups seen for the first time

Group	First victim
mindware	May 5, 2022
cheers	May 29, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
CAVENDERS	blackbasta	—	May 31, 2022
Westwood	lorenz	US	May 31, 2022
AMS-Gruppe	alphv	—	May 31, 2022
CMC Electronics	alphv	CA	May 31, 2022
G&P Projects And Systems S.A.	hive	BR	May 30, 2022
Caracol TV	hive	CO	May 30, 2022
Whitehall (OH)	alphv	—	May 30, 2022
intertabak.com	lockbit2	—	May 30, 2022
inla	lockbit2	—	May 30, 2022
tcpharmachem.co...	lockbit2	—	May 30, 2022
gpmlife.com	lockbit2	—	May 30, 2022
foxconnbc.com	lockbit2	—	May 29, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 251 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.