Ransomware attacks in August 2022
193 victims · 25 active groups · 3 new groups · 216 in July 2022 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 193 ransomware victims claimed on leak sites in August 2022, down 10.6% from 216 in July 2022.
- 25 groups posted at least one victim; the three most active groups, lockbit3 (66), blackbasta (18) and bianlian (12), accounted for 49.7% of the total.
- lockbit3 was the most active group with 66 victims, down from 67 in July 2022.
- Manufacturing was the most-targeted sector with 27 victims (14.0% of the month's total), ahead of Business Services (19).
- Organizations in the United States accounted for 16 victims (8.3%), followed by Canada (4) and the Netherlands (3); 151 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: daixin, icefire and donutleaks.
Daily activity
Busiest day: Aug 6 (24 victims). Quietest day: Aug 5 (1 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | July 2022 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 66 | 34.2% | 67 | −1 |
| 2 | blackbasta | 18 | 9.3% | 24 | −6 |
| 3 | bianlian | 12 | 6.2% | 9 | +3 |
| 4 | icefire | 11 | 5.7% | 0 | +11 |
| 5 | alphv | 11 | 5.7% | 22 | −11 |
| 6 | vicesociety | 8 | 4.1% | 5 | +3 |
| 7 | ragnarlocker | 7 | 3.6% | 2 | +5 |
| 8 | lv | 7 | 3.6% | 6 | +1 |
| 9 | hive | 7 | 3.6% | 29 | −22 |
| 10 | 8base | 7 | 3.6% | 5 | +2 |
| 11 | quantum | 5 | 2.6% | 5 | 0 |
| 12 | donutleaks | 5 | 2.6% | 0 | +5 |
| 13 | blackbyte | 5 | 2.6% | 3 | +2 |
| 14 | dispossessor | 4 | 2.1% | 3 | +1 |
| 15 | ransomexx | 3 | 1.6% | 0 | +3 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 27 | 14.0% |
| 2 | Business Services | 19 | 9.8% |
| 3 | Technology | 14 | 7.3% |
| 4 | Financial Services | 14 | 7.3% |
| 5 | Consumer Services | 14 | 7.3% |
| 6 | Healthcare | 11 | 5.7% |
| 7 | Education | 11 | 5.7% |
| 8 | Construction | 11 | 5.7% |
| 9 | Public Sector | 8 | 4.1% |
| 10 | Energy | 6 | 3.1% |
| 11 | Hospitality and Tourism | 4 | 2.1% |
| 12 | Agriculture and Food Production | 4 | 2.1% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 16 | 8.3% |
| 2 | Canada | 4 | 2.1% |
| 3 | Netherlands | 3 | 1.6% |
| 4 | Germany | 3 | 1.6% |
| 5 | Italy | 2 | 1.0% |
| 6 | United Kingdom | 2 | 1.0% |
| 7 | Australia | 2 | 1.0% |
| 8 | Vietnam | 1 | 0.5% |
| 9 | Singapore | 1 | 0.5% |
| 10 | Malaysia | 1 | 0.5% |
| 11 | Morocco | 1 | 0.5% |
| 12 | Israel | 1 | 0.5% |
| 13 | Haiti | 1 | 0.5% |
| 14 | Egypt | 1 | 0.5% |
| 15 | China | 1 | 0.5% |
151 victims (78.2%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| daixin | Aug 3, 2022 |
| icefire | Aug 20, 2022 |
| donutleaks | Aug 24, 2022 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| USA Insurance company - Smith brothers File tree and some proofs | ragnarlocker | — | Aug 31, 2022 |
| Huge drama for Tap Air Portugal | ragnarlocker | — | Aug 31, 2022 |
| NCG Medical | hive | US | Aug 31, 2022 |
| MEIJI.COM.SG | lockbit3 | SG | Aug 31, 2022 |
| GHT CORP | alphv | — | Aug 30, 2022 |
| Magnachem | bianlian | — | Aug 30, 2022 |
| Alegria Family Services | bianlian | — | Aug 30, 2022 |
| WWAY-TV, LLC | bianlian | — | Aug 30, 2022 |
| Ramada Hervey Bay Hotel Resort | bianlian | — | Aug 30, 2022 |
| Community Dental Partners | bianlian | — | Aug 30, 2022 |
| 4cRisk | bianlian | — | Aug 30, 2022 |
| Captec-group | bianlian | — | Aug 30, 2022 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 193 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.