Ransomware attacks in April 2023
539 victims · 35 active groups · 9 new groups · 510 in March 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 539 ransomware victims claimed on leak sites in April 2023, up 5.7% from 510 in March 2023.
- 35 groups posted at least one victim; the three most active groups, malas (169), lockbit3 (107) and alphv (46), accounted for 59.7% of the total.
- malas was the most active group with 169 victims, after posting none in March 2023.
- Business Services was the most-targeted sector with 106 victims (19.7% of the month's total), ahead of Manufacturing (102).
- Organizations in the United States accounted for 51 victims (9.5%), followed by France (12) and Canada (12); 350 victims did not disclose a location.
- 9 groups appeared in HackerFeeds data for the first time this month, including malas, dunghill and trigona.
Daily activity
Busiest day: Apr 9 (180 victims). Quietest day: Apr 16 (0 victims). Victims were posted on 29 of 30 days.
Most active groups
| # | Group | Victims | Share | March 2023 | Change |
|---|---|---|---|---|---|
| 1 | malas | 169 | 31.4% | 0 | +169 |
| 2 | lockbit3 | 107 | 19.9% | 105 | +2 |
| 3 | alphv | 46 | 8.5% | 32 | +14 |
| 4 | bianlian | 28 | 5.2% | 20 | +8 |
| 5 | blackbasta | 22 | 4.1% | 48 | −26 |
| 6 | royal | 21 | 3.9% | 39 | −18 |
| 7 | dispossessor | 16 | 3.0% | 21 | −5 |
| 8 | play | 14 | 2.6% | 28 | −14 |
| 9 | akira | 12 | 2.2% | 0 | +12 |
| 10 | medusa | 11 | 2.0% | 11 | 0 |
| 11 | karakurt | 11 | 2.0% | 4 | +7 |
| 12 | nokoyawa | 10 | 1.9% | 1 | +9 |
| 13 | blackbyte | 9 | 1.7% | 4 | +5 |
| 14 | trigona | 7 | 1.3% | 0 | +7 |
| 15 | stormous | 7 | 1.3% | 21 | −14 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 106 | 19.7% |
| 2 | Manufacturing | 102 | 18.9% |
| 3 | Technology | 58 | 10.8% |
| 4 | Consumer Services | 46 | 8.5% |
| 5 | Healthcare | 37 | 6.9% |
| 6 | Financial Services | 37 | 6.9% |
| 7 | Construction | 26 | 4.8% |
| 8 | Education | 22 | 4.1% |
| 9 | Agriculture and Food Production | 21 | 3.9% |
| 10 | Transportation/Logistics | 19 | 3.5% |
| 11 | Energy | 16 | 3.0% |
| 12 | Hospitality and Tourism | 15 | 2.8% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 51 | 9.5% |
| 2 | France | 12 | 2.2% |
| 3 | Canada | 12 | 2.2% |
| 4 | Germany | 8 | 1.5% |
| 5 | Brazil | 7 | 1.3% |
| 6 | Malaysia | 6 | 1.1% |
| 7 | Italy | 6 | 1.1% |
| 8 | India | 6 | 1.1% |
| 9 | Japan | 5 | 0.9% |
| 10 | United Kingdom | 5 | 0.9% |
| 11 | Chile | 5 | 0.9% |
| 12 | Australia | 5 | 0.9% |
| 13 | Russia | 4 | 0.7% |
| 14 | Spain | 4 | 0.7% |
| 15 | Philippines | 3 | 0.6% |
350 victims (64.9%) did not disclose a location.
Groups seen for the first time
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| 100X and ALL Clients | ransomhouse | — | Apr 30, 2023 |
| SIIX Corporation | qilin | JP | Apr 30, 2023 |
| CMC Group | vicesociety | — | Apr 30, 2023 |
| Colvillbanks | blackbasta | GB | Apr 30, 2023 |
| Sherman Consulting Services | alphv | — | Apr 29, 2023 |
| KMC Savills | alphv | — | Apr 29, 2023 |
| Our Sunday Visitor | karakurt | — | Apr 29, 2023 |
| ourrelentlesschurch.com | lockbit3 | — | Apr 29, 2023 |
| McDermott International, Ltd | alphv | — | Apr 29, 2023 |
| Great Falls College of Technology | royal | US | Apr 29, 2023 |
| Montana State University | royal | US | Apr 29, 2023 |
| Good Oil Company | 8base | IN | Apr 29, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 539 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.