HackerFeeds
All monthly reports

Ransomware attacks in October 2022

199 victims · 17 active groups · 1 new groups · 225 in September 2022 · Updated Oct 14, 2026

Key findings

  • HackerFeeds recorded 199 ransomware victims claimed on leak sites in October 2022, down 11.6% from 225 in September 2022.
  • 17 groups posted at least one victim; the three most active groups, lockbit3 (59), blackbasta (24) and alphv (23), accounted for 53.3% of the total.
  • lockbit3 was the most active group with 59 victims, down from 112 in September 2022.
  • Manufacturing was the most-targeted sector with 44 victims (22.1% of the month's total), ahead of Healthcare (28).
  • Organizations in the United States accounted for 4 victims (2.0%), followed by Mexico (4) and Japan (4); 148 victims did not disclose a location.
  • One group, dragonforce, appeared in HackerFeeds data for the first time this month.

Daily activity

Busiest day: Oct 23 (20 victims). Quietest day: Oct 8 (1 victims). Victims were posted on 31 of 31 days.

Most active groups

#GroupVictimsShareSeptember 2022Change
1lockbit3
59
29.6%112−53
2blackbasta
24
12.1%20+4
3alphv
23
11.6%17+6
4everest
20
10.1%5+15
5bianlian
14
7.0%3+11
6vicesociety
10
5.0%6+4
7dispossessor
10
5.0%2+8
8ragnarlocker
9
4.5%5+4
9snatch
7
3.5%0+7
10blackbyte
7
3.5%6+1
11ransomexx
5
2.5%1+4
12quantum
2
1.0%20
13qilin
2
1.0%0+2
14lorenz
2
1.0%1+1
15hive
2
1.0%14−12

Targeted sectors

#SectorVictimsShare of month
1Manufacturing44
22.1%
2Healthcare28
14.1%
3Business Services20
10.1%
4Education11
5.5%
5Consumer Services11
5.5%
6Agriculture and Food Production11
5.5%
7Technology9
4.5%
8Energy8
4.0%
9Telecommunication7
3.5%
10Public Sector7
3.5%
11Financial Services7
3.5%
12Construction6
3.0%

Countries

#CountryVictimsShare of month
1United States4
2.0%
2Mexico4
2.0%
3Japan4
2.0%
4Spain4
2.0%
5Taiwan3
1.5%
6Thailand3
1.5%
7Australia3
1.5%
8Poland2
1.0%
9New Zealand2
1.0%
10India2
1.0%
11France2
1.0%
12Germany2
1.0%
13Brazil2
1.0%
14Sweden1
0.5%
15Serbia1
0.5%

148 victims (74.4%) did not disclose a location.

Groups seen for the first time

GroupFirst victim
dragonforceOct 20, 2022

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

VictimGroupCountryDate
Genesys Aerosystemsblackbasta—Oct 31, 2022
Bosselman Energy Incalphv—Oct 31, 2022
STECINT_2blackbasta—Oct 31, 2022
CADEPLOYblackbasta—Oct 31, 2022
zurifurniture.comlockbit3—Oct 31, 2022
will-b.jplockbit3 JPOct 31, 2022
thalesgroup.comlockbit3—Oct 31, 2022
sociedadbilbaina.comlockbit3—Oct 31, 2022
seamlessglobalsolutions.comlockbit3 MXOct 31, 2022
santimuni.comlockbit3—Oct 31, 2022
macrotel.com.arlockbit3 AROct 31, 2022
hoosierco.comlockbit3—Oct 31, 2022

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 199 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.