Ransomware attacks in July 2022

216 victims · 23 active groups · 4 new groups · 158 in June 2022 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 216 ransomware victims claimed on leak sites in July 2022, up 36.7% from 158 in June 2022.
23 groups posted at least one victim; the three most active groups, lockbit3 (67), hive (29) and blackbasta (24), accounted for 55.6% of the total.
lockbit3 was the most active group with 67 victims, up from 3 in June 2022.
Business Services was the most-targeted sector with 42 victims (19.4% of the month's total), ahead of Manufacturing (32).
Organizations in the United States accounted for 13 victims (6.0%), followed by the United Kingdom (7) and France (6); 151 victims did not disclose a location.
4 groups appeared in HackerFeeds data for the first time this month, including yanluowang, 0mega and bianlian.

Daily activity

Busiest day: Jul 6 (20 victims). Quietest day: Jul 8 (1 victims). Victims were posted on 31 of 31 days.

Most active groups

#	Group	Victims	Share	June 2022	Change
1	lockbit3	67	31.0%	3	+64
2	hive	29	13.4%	5	+24
3	blackbasta	24	11.1%	16	+8
4	alphv	22	10.2%	10	+12
5	bianlian	9	4.2%	0	+9
6	everest	7	3.2%	4	+3
7	lv	6	2.8%	8	−2
8	lorenz	6	2.8%	1	+5
9	yanluowang	5	2.3%	0	+5
10	vicesociety	5	2.3%	12	−7
11	quantum	5	2.3%	7	−2
12	8base	5	2.3%	6	−1
13	redalert	4	1.9%	0	+4
14	onyx	4	1.9%	0	+4
15	cheers	4	1.9%	2	+2

Targeted sectors

#	Sector	Victims	Share of month
1	Business Services	42	19.4%
2	Manufacturing	32	14.8%
3	Consumer Services	15	6.9%
4	Financial Services	13	6.0%
5	Technology	12	5.6%
6	Healthcare	12	5.6%
7	Agriculture and Food Production	10	4.6%
8	Transportation/Logistics	9	4.2%
9	Energy	7	3.2%
10	Construction	6	2.8%
11	Public Sector	5	2.3%
12	Education	4	1.9%

Countries

#	Country	Victims	Share of month
1	United States	13	6.0%
2	United Kingdom	7	3.2%
3	France	6	2.8%
4	Netherlands	4	1.9%
5	South Africa	3	1.4%
6	Spain	3	1.4%
7	Australia	3	1.4%
8	Japan	2	0.9%
9	Italy	2	0.9%
10	Ireland	2	0.9%
11	Canada	2	0.9%
12	Brazil	2	0.9%
13	Belgium	2	0.9%
14	Argentina	2	0.9%
15	Taiwan	1	0.5%

151 victims (69.9%) did not disclose a location.

Groups seen for the first time

Group	First victim
yanluowang	Jul 2, 2022
0mega	Jul 14, 2022
bianlian	Jul 14, 2022
redalert	Jul 14, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
BAFNAGROUP.COM - HACKED AND MORE THEN 20 GB DATA LEAKED	lv	—	Jul 31, 2022
get.es	lockbit3	ES	Jul 31, 2022
vytelle.com	lockbit3	—	Jul 31, 2022
emunworks.com	lockbit3	—	Jul 31, 2022
Grupo 2MGA	8base	—	Jul 30, 2022
Creos Luxembourg	alphv	LU	Jul 29, 2022
autoliv.com	lockbit3	—	Jul 29, 2022
Hong Kong Special Care Dentistry Association Limited	lv	—	Jul 29, 2022
Nelsonslaw LLP	alphv	GB	Jul 29, 2022
Fandeli	lorenz	—	Jul 29, 2022
Intermountain	8base	—	Jul 29, 2022
fruca.es	lockbit3	ES	Jul 28, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 216 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.