Ransomware attacks in May 2023
360 victims · 34 active groups · 7 new groups · 539 in April 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 360 ransomware victims claimed on leak sites in May 2023, down 33.2% from 539 in April 2023.
- 34 groups posted at least one victim; the three most active groups, lockbit3 (77), alphv (40) and bianlian (35), accounted for 42.2% of the total.
- lockbit3 was the most active group with 77 victims, down from 107 in April 2023.
- Business Services was the most-targeted sector with 62 victims (17.2% of the month's total), ahead of Manufacturing (59).
- Organizations in the United States accounted for 32 victims (8.9%), followed by Germany (13) and the United Kingdom (10); 201 victims did not disclose a location.
- 7 groups appeared in HackerFeeds data for the first time this month, including rancoz, termite and werewolves.
Daily activity
Busiest day: May 22 (40 victims). Quietest day: May 6 (2 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | April 2023 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 77 | 21.4% | 107 | −30 |
| 2 | alphv | 40 | 11.1% | 46 | −6 |
| 3 | bianlian | 35 | 9.7% | 28 | +7 |
| 4 | play | 27 | 7.5% | 14 | +13 |
| 5 | royal | 25 | 6.9% | 21 | +4 |
| 6 | akira | 23 | 6.4% | 12 | +11 |
| 7 | medusa | 16 | 4.4% | 11 | +5 |
| 8 | dispossessor | 13 | 3.6% | 16 | −3 |
| 9 | monti | 12 | 3.3% | 0 | +12 |
| 10 | trigona | 11 | 3.1% | 7 | +4 |
| 11 | nokoyawa | 11 | 3.1% | 10 | +1 |
| 12 | snatch | 9 | 2.5% | 2 | +7 |
| 13 | blackbasta | 8 | 2.2% | 22 | −14 |
| 14 | qilin | 7 | 1.9% | 2 | +5 |
| 15 | vicesociety | 5 | 1.4% | 4 | +1 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 62 | 17.2% |
| 2 | Manufacturing | 59 | 16.4% |
| 3 | Technology | 44 | 12.2% |
| 4 | Healthcare | 40 | 11.1% |
| 5 | Financial Services | 27 | 7.5% |
| 6 | Education | 25 | 6.9% |
| 7 | Construction | 17 | 4.7% |
| 8 | Consumer Services | 15 | 4.2% |
| 9 | Agriculture and Food Production | 14 | 3.9% |
| 10 | Public Sector | 11 | 3.1% |
| 11 | Hospitality and Tourism | 10 | 2.8% |
| 12 | Energy | 10 | 2.8% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 32 | 8.9% |
| 2 | Germany | 13 | 3.6% |
| 3 | United Kingdom | 10 | 2.8% |
| 4 | Canada | 10 | 2.8% |
| 5 | France | 8 | 2.2% |
| 6 | Spain | 7 | 1.9% |
| 7 | Italy | 6 | 1.7% |
| 8 | Mexico | 5 | 1.4% |
| 9 | South Africa | 4 | 1.1% |
| 10 | Switzerland | 4 | 1.1% |
| 11 | Austria | 4 | 1.1% |
| 12 | Sweden | 3 | 0.8% |
| 13 | Netherlands | 3 | 0.8% |
| 14 | Indonesia | 3 | 0.8% |
| 15 | Colombia | 3 | 0.8% |
201 victims (55.8%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| rancoz | May 5, 2023 |
| termite | May 11, 2023 |
| werewolves | May 18, 2023 |
| lynx | May 22, 2023 |
| coinbasecartel | May 26, 2023 |
| darkrace | May 30, 2023 |
| underground | May 30, 2023 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| buckprop.com | lockbit3 | — | May 31, 2023 |
| Sur La Table | blackbasta | US | May 31, 2023 |
| Pacific Union College | trigona | — | May 30, 2023 |
| credicoop.coop.py | lockbit3 | PY | May 30, 2023 |
| nycollege.edu | lockbit3 | US | May 30, 2023 |
| fixscr.com | lockbit3 | UY | May 30, 2023 |
| columbuscitizens.org | lockbit3 | — | May 30, 2023 |
| Servizi Omnia All data upload | monti | — | May 30, 2023 |
| McCarthy Fingar | blackbasta | — | May 30, 2023 |
| casepointcom (UPDATE) | alphv | — | May 30, 2023 |
| The National Association of Home Builders | akira | — | May 30, 2023 |
| SK Life Science | akira | — | May 30, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 360 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.