Ransomware attacks in July 2023
545 victims · 42 active groups · 1 new groups · 448 in June 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 545 ransomware victims claimed on leak sites in July 2023, up 21.7% from 448 in June 2023.
- 42 groups posted at least one victim; the three most active groups, clop (171), lockbit3 (51) and 8base (37), accounted for 47.5% of the total.
- clop was the most active group with 171 victims, up from 90 in June 2023.
- Business Services was the most-targeted sector with 96 victims (17.6% of the month's total), ahead of Manufacturing (85).
- Organizations in the United States accounted for 45 victims (8.3%), followed by the United Kingdom (17) and Italy (14); 349 victims did not disclose a location.
- One group, cactus, appeared in HackerFeeds data for the first time this month.
Daily activity
Busiest day: Jul 26 (79 victims). Quietest day: Jul 2 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | June 2023 | Change |
|---|---|---|---|---|---|
| 1 | clop | 171 | 31.4% | 90 | +81 |
| 2 | lockbit3 | 51 | 9.4% | 63 | −12 |
| 3 | 8base | 37 | 6.8% | 39 | −2 |
| 4 | alphv | 32 | 5.9% | 27 | +5 |
| 5 | bianlian | 27 | 5.0% | 22 | +5 |
| 6 | play | 25 | 4.6% | 26 | −1 |
| 7 | akira | 21 | 3.9% | 28 | −7 |
| 8 | cactus | 20 | 3.7% | 0 | +20 |
| 9 | noescape | 17 | 3.1% | 7 | +10 |
| 10 | stormous | 16 | 2.9% | 0 | +16 |
| 11 | rhysida | 16 | 2.9% | 20 | −4 |
| 12 | medusa | 12 | 2.2% | 11 | +1 |
| 13 | dispossessor | 12 | 2.2% | 18 | −6 |
| 14 | nokoyawa | 7 | 1.3% | 0 | +7 |
| 15 | blackbasta | 6 | 1.1% | 10 | −4 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 96 | 17.6% |
| 2 | Manufacturing | 85 | 15.6% |
| 3 | Consumer Services | 50 | 9.2% |
| 4 | Healthcare | 44 | 8.1% |
| 5 | Technology | 42 | 7.7% |
| 6 | Financial Services | 42 | 7.7% |
| 7 | Construction | 29 | 5.3% |
| 8 | Energy | 26 | 4.8% |
| 9 | Education | 25 | 4.6% |
| 10 | Transportation/Logistics | 20 | 3.7% |
| 11 | Public Sector | 19 | 3.5% |
| 12 | Agriculture and Food Production | 19 | 3.5% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 45 | 8.3% |
| 2 | United Kingdom | 17 | 3.1% |
| 3 | Italy | 14 | 2.6% |
| 4 | Australia | 9 | 1.7% |
| 5 | India | 8 | 1.5% |
| 6 | Spain | 8 | 1.5% |
| 7 | Germany | 8 | 1.5% |
| 8 | Canada | 8 | 1.5% |
| 9 | France | 7 | 1.3% |
| 10 | Mexico | 4 | 0.7% |
| 11 | Singapore | 3 | 0.6% |
| 12 | Netherlands | 3 | 0.6% |
| 13 | Japan | 3 | 0.6% |
| 14 | Iran | 3 | 0.6% |
| 15 | China | 3 | 0.6% |
349 victims (64.0%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| cactus | Jul 3, 2023 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Great Opportunity to monetize your corporate access | everest | — | Jul 31, 2023 |
| obrelli.it | lockbit3 | IT | Jul 31, 2023 |
| nbcc.org | lockbit3 | — | Jul 31, 2023 |
| paretophone.com | lockbit3 | — | Jul 31, 2023 |
| Batesville Tool & Die, Inc will be leaked in 3 Days | ragnarlocker | — | Jul 31, 2023 |
| hydrex.co.uk | cuba | GB | Jul 31, 2023 |
| txmplant.co.uk | cuba | GB | Jul 31, 2023 |
| TELNET Redes Inteligentes S.A. | bianlian | — | Jul 31, 2023 |
| Retail Information Systems | bianlian | — | Jul 31, 2023 |
| llombart.de | lockbit3 | DE | Jul 31, 2023 |
| westoaksschool.co.uk | lockbit3 | GB | Jul 31, 2023 |
| St Landry Parish School Board | medusa | — | Jul 31, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 545 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.