Ransomware attacks in September 2022
225 victims · 24 active groups · 1 new groups · 193 in August 2022 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 225 ransomware victims claimed on leak sites in September 2022, up 16.6% from 193 in August 2022.
- 24 groups posted at least one victim; the three most active groups, lockbit3 (112), blackbasta (20) and alphv (17), accounted for 66.2% of the total.
- lockbit3 was the most active group with 112 victims, up from 66 in August 2022.
- Business Services was the most-targeted sector with 35 victims (15.6% of the month's total), ahead of Manufacturing (30).
- Organizations in the United States accounted for 12 victims (5.3%), followed by France (12) and Taiwan (6); 149 victims did not disclose a location.
- One group, sparta, appeared in HackerFeeds data for the first time this month.
Daily activity
Busiest day: Sep 14 (39 victims). Quietest day: Sep 10 (0 victims). Victims were posted on 29 of 30 days.
Most active groups
| # | Group | Victims | Share | August 2022 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 112 | 49.8% | 66 | +46 |
| 2 | blackbasta | 20 | 8.9% | 18 | +2 |
| 3 | alphv | 17 | 7.6% | 11 | +6 |
| 4 | sparta | 14 | 6.2% | 0 | +14 |
| 5 | hive | 14 | 6.2% | 7 | +7 |
| 6 | vicesociety | 6 | 2.7% | 8 | −2 |
| 7 | blackbyte | 6 | 2.7% | 5 | +1 |
| 8 | ragnarlocker | 5 | 2.2% | 7 | −2 |
| 9 | everest | 5 | 2.2% | 2 | +3 |
| 10 | 8base | 4 | 1.8% | 7 | −3 |
| 11 | bianlian | 3 | 1.3% | 12 | −9 |
| 12 | redalert | 2 | 0.9% | 0 | +2 |
| 13 | quantum | 2 | 0.9% | 5 | −3 |
| 14 | donutleaks | 2 | 0.9% | 5 | −3 |
| 15 | dispossessor | 2 | 0.9% | 4 | −2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 35 | 15.6% |
| 2 | Manufacturing | 30 | 13.3% |
| 3 | Healthcare | 18 | 8.0% |
| 4 | Consumer Services | 17 | 7.6% |
| 5 | Public Sector | 14 | 6.2% |
| 6 | Technology | 12 | 5.3% |
| 7 | Financial Services | 12 | 5.3% |
| 8 | Hospitality and Tourism | 11 | 4.9% |
| 9 | Education | 10 | 4.4% |
| 10 | Agriculture and Food Production | 10 | 4.4% |
| 11 | Energy | 9 | 4.0% |
| 12 | Construction | 9 | 4.0% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 12 | 5.3% |
| 2 | France | 12 | 5.3% |
| 3 | Taiwan | 6 | 2.7% |
| 4 | Brazil | 5 | 2.2% |
| 5 | Germany | 4 | 1.8% |
| 6 | Canada | 3 | 1.3% |
| 7 | Turkey | 2 | 0.9% |
| 8 | Philippines | 2 | 0.9% |
| 9 | New Zealand | 2 | 0.9% |
| 10 | Japan | 2 | 0.9% |
| 11 | Italy | 2 | 0.9% |
| 12 | United Kingdom | 2 | 0.9% |
| 13 | Spain | 2 | 0.9% |
| 14 | Colombia | 2 | 0.9% |
| 15 | Belgium | 2 | 0.9% |
149 victims (66.2%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| sparta | Sep 13, 2022 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Karl Gemünden GmbH & Co. KG | blackbasta | — | Sep 30, 2022 |
| Bilthoven Biologicals | alphv | NL | Sep 30, 2022 |
| Mansfield Independent School District (MISD) | hive | — | Sep 30, 2022 |
| aidsalabama.org | lockbit3 | — | Sep 30, 2022 |
| toyotaalabang.com.ph | lockbit3 | PH | Sep 30, 2022 |
| Los Angeles Unified School District | vicesociety | — | Sep 30, 2022 |
| Associated Bag | blackbasta | — | Sep 29, 2022 |
| Stages Pediatric Care | everest | — | Sep 29, 2022 |
| Midwest Petroleum | alphv | — | Sep 29, 2022 |
| samyang.com | lockbit3 | — | Sep 29, 2022 |
| Evo exhibits | donutleaks | — | Sep 28, 2022 |
| NJVC [ post has been updated ] | alphv | — | Sep 28, 2022 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 225 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.