Ransomware attacks in March 2023

510 victims · 32 active groups · 5 new groups · 287 in February 2023 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 510 ransomware victims claimed on leak sites in March 2023, up 77.7% from 287 in February 2023.
32 groups posted at least one victim; the three most active groups, lockbit3 (105), clop (104) and blackbasta (48), accounted for 50.4% of the total.
lockbit3 was the most active group with 105 victims, down from 131 in February 2023.
Business Services was the most-targeted sector with 91 victims (17.8% of the month's total), ahead of Manufacturing (82).
Organizations in the United States accounted for 58 victims (11.4%), followed by the United Kingdom (20) and Germany (15); 286 victims did not disclose a location.
5 groups appeared in HackerFeeds data for the first time this month, including ransomhub, darkpower and abyss.

Daily activity

Busiest day: Mar 23 (50 victims). Quietest day: Mar 12 (1 victims). Victims were posted on 31 of 31 days.

Most active groups

#	Group	Victims	Share	February 2023	Change
1	lockbit3	105	20.6%	131	−26
2	clop	104	20.4%	0	+104
3	blackbasta	48	9.4%	0	+48
4	royal	39	7.6%	15	+24
5	alphv	32	6.3%	29	+3
6	play	28	5.5%	11	+17
7	stormous	21	4.1%	0	+21
8	dispossessor	21	4.1%	17	+4
9	bianlian	20	3.9%	19	+1
10	ransomhouse	12	2.4%	5	+7
11	medusa	11	2.2%	14	−3
12	darkpower	10	2.0%	0	+10
13	vicesociety	8	1.6%	2	+6
14	abyss	8	1.6%	0	+8
15	monti	6	1.2%	0	+6

Targeted sectors

#	Sector	Victims	Share of month
1	Business Services	91	17.8%
2	Manufacturing	82	16.1%
3	Consumer Services	38	7.5%
4	Healthcare	37	7.3%
5	Technology	34	6.7%
6	Financial Services	32	6.3%
7	Public Sector	28	5.5%
8	Construction	28	5.5%
9	Transportation/Logistics	27	5.3%
10	Agriculture and Food Production	21	4.1%
11	Education	20	3.9%
12	Energy	16	3.1%

Countries

#	Country	Victims	Share of month
1	United States	58	11.4%
2	United Kingdom	20	3.9%
3	Germany	15	2.9%
4	France	12	2.4%
5	Canada	12	2.4%
6	India	11	2.2%
7	Italy	8	1.6%
8	Australia	7	1.4%
9	Spain	6	1.2%
10	Japan	5	1.0%
11	Brazil	5	1.0%
12	South Africa	4	0.8%
13	Argentina	4	0.8%
14	United Arab Emirates	4	0.8%
15	Turkey	3	0.6%

286 victims (56.1%) did not disclose a location.

Groups seen for the first time

Group	First victim
ransomhub	Mar 9, 2023
darkpower	Mar 11, 2023
abyss	Mar 21, 2023
ALP-001	Mar 27, 2023
nitrogen	Mar 29, 2023

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
ativy.com	lockbit3	—	Mar 31, 2023
OptionMetrics	karakurt	—	Mar 31, 2023
etkinllc.com	lockbit3	—	Mar 31, 2023
123.com	lockbit3	—	Mar 31, 2023
Lewis & Clark College	vicesociety	US	Mar 31, 2023
hacla.org [part 2]	lockbit3	—	Mar 31, 2023
hacla.org	dispossessor	—	Mar 31, 2023
Armstrong Watson	royal	GB	Mar 31, 2023
Garden Hotel NARITA	donutleaks	—	Mar 31, 2023
Montgomery General Hospital	donutleaks	—	Mar 31, 2023
Nabtesco Motion Control	donutleaks	—	Mar 31, 2023
GOV.PL	stormous	PL	Mar 30, 2023

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 510 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.