Ransomware attacks in January 2023
179 victims · 23 active groups · 2 new groups · 534 in December 2022 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 179 ransomware victims claimed on leak sites in January 2023, down 66.5% from 534 in December 2022.
- 23 groups posted at least one victim; the three most active groups, lockbit3 (48), vicesociety (23) and alphv (22), accounted for 52.0% of the total.
- lockbit3 was the most active group with 48 victims, down from 58 in December 2022.
- Business Services was the most-targeted sector with 29 victims (16.2% of the month's total), ahead of Manufacturing (28).
- Organizations in the United States accounted for 11 victims (6.1%), followed by the United Kingdom (11) and Australia (10); 92 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: moneymessage and medusa.
Daily activity
Busiest day: Jan 30 (17 victims). Quietest day: Jan 19 (0 victims). Victims were posted on 30 of 31 days.
Most active groups
| # | Group | Victims | Share | December 2022 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 48 | 26.8% | 58 | −10 |
| 2 | vicesociety | 23 | 12.8% | 19 | +4 |
| 3 | alphv | 22 | 12.3% | 25 | −3 |
| 4 | royal | 20 | 11.2% | 45 | −25 |
| 5 | play | 15 | 8.4% | 25 | −10 |
| 6 | mallox | 7 | 3.9% | 1 | +6 |
| 7 | blackbyte | 6 | 3.4% | 1 | +5 |
| 8 | medusa | 5 | 2.8% | 0 | +5 |
| 9 | bianlian | 5 | 2.8% | 37 | −32 |
| 10 | 8base | 5 | 2.8% | 8 | −3 |
| 11 | ransomhouse | 3 | 1.7% | 12 | −9 |
| 12 | lorenz | 3 | 1.7% | 1 | +2 |
| 13 | hive | 3 | 1.7% | 15 | −12 |
| 14 | clop | 3 | 1.7% | 122 | −119 |
| 15 | nokoyawa | 2 | 1.1% | 1 | +1 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 29 | 16.2% |
| 2 | Manufacturing | 28 | 15.6% |
| 3 | Education | 18 | 10.1% |
| 4 | Consumer Services | 14 | 7.8% |
| 5 | Healthcare | 11 | 6.1% |
| 6 | Financial Services | 11 | 6.1% |
| 7 | Transportation/Logistics | 10 | 5.6% |
| 8 | Public Sector | 10 | 5.6% |
| 9 | Technology | 9 | 5.0% |
| 10 | Agriculture and Food Production | 8 | 4.5% |
| 11 | Energy | 6 | 3.4% |
| 12 | Construction | 6 | 3.4% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 11 | 6.1% |
| 2 | United Kingdom | 11 | 6.1% |
| 3 | Australia | 10 | 5.6% |
| 4 | Germany | 5 | 2.8% |
| 5 | Mexico | 4 | 2.2% |
| 6 | France | 4 | 2.2% |
| 7 | Portugal | 3 | 1.7% |
| 8 | Italy | 3 | 1.7% |
| 9 | Austria | 3 | 1.7% |
| 10 | Taiwan | 2 | 1.1% |
| 11 | Thailand | 2 | 1.1% |
| 12 | Singapore | 2 | 1.1% |
| 13 | Saudi Arabia | 2 | 1.1% |
| 14 | Philippines | 2 | 1.1% |
| 15 | Netherlands | 2 | 1.1% |
92 victims (51.4%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| moneymessage | Jan 4, 2023 |
| medusa | Jan 11, 2023 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Westmont Hospitality Group | alphv | — | Jan 31, 2023 |
| TechInsights | vicesociety | — | Jan 31, 2023 |
| Societa Italiana Brevetti SpA | vicesociety | IT | Jan 31, 2023 |
| PARIC CORPORATION | alphv | — | Jan 31, 2023 |
| Bregman Berbert Schwartz & Gilday | alphv | — | Jan 31, 2023 |
| Stibbs & Co | alphv | — | Jan 31, 2023 |
| V3 Companies | alphv | — | Jan 31, 2023 |
| Vision Technologies | alphv | — | Jan 31, 2023 |
| 2cara.fr | lockbit3 | FR | Jan 31, 2023 |
| tcels.or.th | lockbit3 | TH | Jan 31, 2023 |
| parkavedoors.com | lockbit3 | — | Jan 31, 2023 |
| geraardsbergen.be | lockbit3 | BE | Jan 31, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 179 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.