All monthly reports
Ransomware attacks in June 2023
448 victims · 33 active groups · 5 new groups · 360 in May 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 448 ransomware victims claimed on leak sites in June 2023, up 24.4% from 360 in May 2023.
- 33 groups posted at least one victim; the three most active groups, clop (90), lockbit3 (63) and 8base (39), accounted for 42.9% of the total.
- clop was the most active group with 90 victims, up from 2 in May 2023.
- Business Services was the most-targeted sector with 73 victims (16.3% of the month's total), ahead of Manufacturing (61).
- Organizations in the United States accounted for 43 victims (9.6%), followed by Brazil (12) and the United Kingdom (11); 253 victims did not disclose a location.
- 5 groups appeared in HackerFeeds data for the first time this month, including rhysida, noescape and devman.
Daily activity
Busiest day: Jun 14 (33 victims). Quietest day: Jun 25 (2 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | May 2023 | Change |
|---|---|---|---|---|---|
| 1 | clop | 90 | 20.1% | 2 | +88 |
| 2 | lockbit3 | 63 | 14.1% | 77 | −14 |
| 3 | 8base | 39 | 8.7% | 1 | +38 |
| 4 | akira | 28 | 6.3% | 23 | +5 |
| 5 | alphv | 27 | 6.0% | 40 | −13 |
| 6 | play | 26 | 5.8% | 27 | −1 |
| 7 | bianlian | 22 | 4.9% | 35 | −13 |
| 8 | rhysida | 20 | 4.5% | 0 | +20 |
| 9 | dispossessor | 18 | 4.0% | 13 | +5 |
| 10 | snatch | 15 | 3.3% | 9 | +6 |
| 11 | medusa | 11 | 2.5% | 16 | −5 |
| 12 | qilin | 10 | 2.2% | 7 | +3 |
| 13 | blackbasta | 10 | 2.2% | 8 | +2 |
| 14 | darkrace | 9 | 2.0% | 1 | +8 |
| 15 | noescape | 7 | 1.6% | 0 | +7 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 73 | 16.3% |
| 2 | Manufacturing | 61 | 13.6% |
| 3 | Financial Services | 48 | 10.7% |
| 4 | Healthcare | 47 | 10.5% |
| 5 | Education | 37 | 8.3% |
| 6 | Construction | 34 | 7.6% |
| 7 | Technology | 27 | 6.0% |
| 8 | Transportation/Logistics | 22 | 4.9% |
| 9 | Consumer Services | 17 | 3.8% |
| 10 | Agriculture and Food Production | 16 | 3.6% |
| 11 | Hospitality and Tourism | 14 | 3.1% |
| 12 | Public Sector | 13 | 2.9% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 43 | 9.6% |
| 2 | Brazil | 12 | 2.7% |
| 3 | United Kingdom | 11 | 2.5% |
| 4 | Canada | 11 | 2.5% |
| 5 | France | 8 | 1.8% |
| 6 | India | 7 | 1.6% |
| 7 | Switzerland | 7 | 1.6% |
| 8 | Australia | 7 | 1.6% |
| 9 | Netherlands | 6 | 1.3% |
| 10 | Italy | 6 | 1.3% |
| 11 | Germany | 6 | 1.3% |
| 12 | Japan | 5 | 1.1% |
| 13 | South Africa | 4 | 0.9% |
| 14 | Sweden | 4 | 0.9% |
| 15 | Spain | 4 | 0.9% |
253 victims (56.5%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| ENCORECAPITAL.COM | clop | — | Jun 30, 2023 |
| TRELLISWARE.COM | clop | — | Jun 30, 2023 |
| CLICKSGROUP.CO.ZA | clop | ZA | Jun 30, 2023 |
| HORNBECKOFFSHORE.COM | clop | — | Jun 30, 2023 |
| FISGLOBAL.COM | clop | — | Jun 30, 2023 |
| DIGITALINSIGHT.COM | clop | — | Jun 30, 2023 |
| IRONBOW.COM | clop | — | Jun 30, 2023 |
| VERICAST.COM | clop | — | Jun 30, 2023 |
| RHENUS.GROUP | clop | — | Jun 30, 2023 |
| SOVOS.COM | clop | — | Jun 30, 2023 |
| HARRINGTONCOMPANY.COM | clop | — | Jun 30, 2023 |
| CITYNATIONAL.COM | clop | — | Jun 30, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 448 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.