Ransomware attacks in June 2022
158 victims · 23 active groups · 3 new groups · 251 in May 2022 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 158 ransomware victims claimed on leak sites in June 2022, down 37.1% from 251 in May 2022.
- 23 groups posted at least one victim; the three most active groups, lockbit2 (64), blackbasta (16) and vicesociety (12), accounted for 58.2% of the total.
- lockbit2 was the most active group with 64 victims, down from 99 in May 2022.
- Manufacturing was the most-targeted sector with 28 victims (17.7% of the month's total), ahead of Business Services (23).
- Organizations in the United States accounted for 13 victims (8.2%), followed by Italy (2) and the United Kingdom (2); 126 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: SilentRansomGroup, worldleaks and la_piovra.
Daily activity
Busiest day: Jun 14 (17 victims). Quietest day: Jun 19 (1 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | May 2022 | Change |
|---|---|---|---|---|---|
| 1 | lockbit2 | 64 | 40.5% | 99 | −35 |
| 2 | blackbasta | 16 | 10.1% | 18 | −2 |
| 3 | vicesociety | 12 | 7.6% | 10 | +2 |
| 4 | alphv | 10 | 6.3% | 18 | −8 |
| 5 | lv | 8 | 5.1% | 2 | +6 |
| 6 | quantum | 7 | 4.4% | 7 | 0 |
| 7 | 8base | 6 | 3.8% | 3 | +3 |
| 8 | hive | 5 | 3.2% | 17 | −12 |
| 9 | ragnarlocker | 4 | 2.5% | 2 | +2 |
| 10 | everest | 4 | 2.5% | 3 | +1 |
| 11 | lockbit3 | 3 | 1.9% | 0 | +3 |
| 12 | dispossessor | 3 | 1.9% | 2 | +1 |
| 13 | suncrypt | 2 | 1.3% | 0 | +2 |
| 14 | snatch | 2 | 1.3% | 1 | +1 |
| 15 | cuba | 2 | 1.3% | 2 | 0 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 28 | 17.7% |
| 2 | Business Services | 23 | 14.6% |
| 3 | Technology | 13 | 8.2% |
| 4 | Consumer Services | 13 | 8.2% |
| 5 | Healthcare | 10 | 6.3% |
| 6 | Public Sector | 9 | 5.7% |
| 7 | Education | 9 | 5.7% |
| 8 | Construction | 9 | 5.7% |
| 9 | Transportation/Logistics | 8 | 5.1% |
| 10 | Agriculture and Food Production | 6 | 3.8% |
| 11 | Financial Services | 5 | 3.2% |
| 12 | Telecommunication | 3 | 1.9% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 13 | 8.2% |
| 2 | Italy | 2 | 1.3% |
| 3 | United Kingdom | 2 | 1.3% |
| 4 | France | 2 | 1.3% |
| 5 | Canada | 2 | 1.3% |
| 6 | Australia | 2 | 1.3% |
| 7 | South Africa | 1 | 0.6% |
| 8 | Mexico | 1 | 0.6% |
| 9 | Japan | 1 | 0.6% |
| 10 | Ireland | 1 | 0.6% |
| 11 | Indonesia | 1 | 0.6% |
| 12 | Hungary | 1 | 0.6% |
| 13 | Spain | 1 | 0.6% |
| 14 | Bermuda | 1 | 0.6% |
| 15 | Argentina | 1 | 0.6% |
126 victims (79.7%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| SilentRansomGroup | Jun 7, 2022 |
| worldleaks | Jun 23, 2022 |
| la_piovra | Jun 25, 2022 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Atlantic Dialysis Management Services | snatch | US | Jun 30, 2022 |
| https:// | cheers | — | Jun 30, 2022 |
| diodes.com | lockbit3 | — | Jun 30, 2022 |
| Crupi Group | quantum | CA | Jun 30, 2022 |
| Apex | snatch | BM | Jun 29, 2022 |
| Avante Health Solutions | quantum | US | Jun 29, 2022 |
| New Peoples Bank | blackbasta | — | Jun 29, 2022 |
| metroappliancesandmore.com | lockbit3 | — | Jun 29, 2022 |
| lonseal.com | lockbit3 | — | Jun 29, 2022 |
| Sembcorp Marine - Unpay | cheers | — | Jun 28, 2022 |
| SuperAlloy Industrial Co., Ltd. | hive | GB | Jun 28, 2022 |
| Diskriter | hive | US | Jun 28, 2022 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 158 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.