Ransomware attacks in February 2023
287 victims · 23 active groups · 2 new groups · 179 in January 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 287 ransomware victims claimed on leak sites in February 2023, up 60.3% from 179 in January 2023.
- 23 groups posted at least one victim; the three most active groups, lockbit3 (131), alphv (29) and bianlian (19), accounted for 62.4% of the total.
- lockbit3 was the most active group with 131 victims, up from 48 in January 2023.
- Manufacturing was the most-targeted sector with 43 victims (15.0% of the month's total), ahead of Business Services (43).
- Organizations in the United States accounted for 23 victims (8.0%), followed by the United Kingdom (8) and Brazil (8); 167 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: vendetta and thegentlemen.
Daily activity
Busiest day: Feb 12 (21 victims). Quietest day: Feb 25 (0 victims). Victims were posted on 27 of 28 days.
Most active groups
| # | Group | Victims | Share | January 2023 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 131 | 45.6% | 48 | +83 |
| 2 | alphv | 29 | 10.1% | 22 | +7 |
| 3 | bianlian | 19 | 6.6% | 5 | +14 |
| 4 | dispossessor | 17 | 5.9% | 2 | +15 |
| 5 | royal | 15 | 5.2% | 20 | −5 |
| 6 | medusa | 14 | 4.9% | 5 | +9 |
| 7 | 8base | 12 | 4.2% | 5 | +7 |
| 8 | play | 11 | 3.8% | 15 | −4 |
| 9 | avoslocker | 9 | 3.1% | 1 | +8 |
| 10 | ransomhouse | 5 | 1.7% | 3 | +2 |
| 11 | mallox | 5 | 1.7% | 7 | −2 |
| 12 | vendetta | 3 | 1.0% | 0 | +3 |
| 13 | vicesociety | 2 | 0.7% | 23 | −21 |
| 14 | snatch | 2 | 0.7% | 1 | +1 |
| 15 | ransomexx | 2 | 0.7% | 0 | +2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 43 | 15.0% |
| 2 | Business Services | 43 | 15.0% |
| 3 | Consumer Services | 23 | 8.0% |
| 4 | Transportation/Logistics | 21 | 7.3% |
| 5 | Healthcare | 21 | 7.3% |
| 6 | Agriculture and Food Production | 21 | 7.3% |
| 7 | Financial Services | 19 | 6.6% |
| 8 | Construction | 18 | 6.3% |
| 9 | Technology | 16 | 5.6% |
| 10 | Education | 16 | 5.6% |
| 11 | Energy | 15 | 5.2% |
| 12 | Public Sector | 10 | 3.5% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| vendetta | Feb 12, 2023 |
| thegentlemen | Feb 28, 2023 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| hafele.com | lockbit3 | — | Feb 28, 2023 |
| indigo.ca | lockbit3 | CA | Feb 28, 2023 |
| Kimko Realty | alphv | — | Feb 28, 2023 |
| globalcommunities.org | lockbit3 | — | Feb 28, 2023 |
| cobcreditunion.com | lockbit3 | — | Feb 28, 2023 |
| wmich.edu | lockbit3 | US | Feb 28, 2023 |
| georgeleslie.co.uk | lockbit3 | GB | Feb 28, 2023 |
| df.senac.br | lockbit3 | BR | Feb 28, 2023 |
| haeco.com | lockbit3 | — | Feb 28, 2023 |
| nokair.com | lockbit3 | TH | Feb 28, 2023 |
| princepalace.co.th | lockbit3 | JP | Feb 28, 2023 |
| lsa-international.com | lockbit3 | — | Feb 28, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 287 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.