All monthly reports
Ransomware attacks in August 2023
465 victims · 37 active groups · 6 new groups · 545 in July 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 465 ransomware victims claimed on leak sites in August 2023, down 14.7% from 545 in July 2023.
- 37 groups posted at least one victim; the three most active groups, lockbit3 (125), alphv (43) and 8base (34), accounted for 43.4% of the total.
- lockbit3 was the most active group with 125 victims, up from 51 in July 2023.
- Business Services was the most-targeted sector with 91 victims (19.6% of the month's total), ahead of Manufacturing (65).
- Organizations in the United States accounted for 47 victims (10.1%), followed by Germany (16) and the United Kingdom (15); 243 victims did not disclose a location.
- 6 groups appeared in HackerFeeds data for the first time this month, including threeam, incransom and metaencryptor.
Daily activity
Busiest day: Aug 24 (41 victims). Quietest day: Aug 12 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | July 2023 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 125 | 26.9% | 51 | +74 |
| 2 | alphv | 43 | 9.2% | 32 | +11 |
| 3 | 8base | 34 | 7.3% | 37 | −3 |
| 4 | dispossessor | 32 | 6.9% | 12 | +20 |
| 5 | akira | 30 | 6.5% | 21 | +9 |
| 6 | cloak | 24 | 5.2% | 0 | +24 |
| 7 | play | 22 | 4.7% | 25 | −3 |
| 8 | noescape | 22 | 4.7% | 17 | +5 |
| 9 | metaencryptor | 12 | 2.6% | 0 | +12 |
| 10 | medusa | 12 | 2.6% | 12 | 0 |
| 11 | bianlian | 12 | 2.6% | 27 | −15 |
| 12 | ransomed | 11 | 2.4% | 0 | +11 |
| 13 | cactus | 9 | 1.9% | 20 | −11 |
| 14 | rhysida | 8 | 1.7% | 16 | −8 |
| 15 | clop | 7 | 1.5% | 171 | −164 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 91 | 19.6% |
| 2 | Manufacturing | 65 | 14.0% |
| 3 | Technology | 35 | 7.5% |
| 4 | Education | 35 | 7.5% |
| 5 | Consumer Services | 34 | 7.3% |
| 6 | Construction | 30 | 6.5% |
| 7 | Healthcare | 29 | 6.2% |
| 8 | Financial Services | 25 | 5.4% |
| 9 | Agriculture and Food Production | 20 | 4.3% |
| 10 | Public Sector | 18 | 3.9% |
| 11 | Energy | 14 | 3.0% |
| 12 | Transportation/Logistics | 13 | 2.8% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 47 | 10.1% |
| 2 | Germany | 16 | 3.4% |
| 3 | United Kingdom | 15 | 3.2% |
| 4 | France | 15 | 3.2% |
| 5 | Australia | 11 | 2.4% |
| 6 | Italy | 10 | 2.2% |
| 7 | Canada | 10 | 2.2% |
| 8 | India | 8 | 1.7% |
| 9 | Thailand | 6 | 1.3% |
| 10 | Mexico | 5 | 1.1% |
| 11 | South Africa | 4 | 0.9% |
| 12 | Switzerland | 4 | 0.9% |
| 13 | Brazil | 4 | 0.9% |
| 14 | Turkey | 3 | 0.6% |
| 15 | Portugal | 3 | 0.6% |
243 victims (52.3%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| chevalerias.com | lockbit3 | — | Aug 31, 2023 |
| deschamps.fr | lockbit3 | FR | Aug 31, 2023 |
| guyer.com.uy | lockbit3 | UY | Aug 31, 2023 |
| mayair.com.my | lockbit3 | MY | Aug 31, 2023 |
| MetroCLub DC | ransomed | — | Aug 31, 2023 |
| abzarsara.com | lockbit3 | IR | Aug 31, 2023 |
| Valley Mountain Regional Center | karakurt | — | Aug 31, 2023 |
| New York & Company | akira | — | Aug 31, 2023 |
| Children's Home of Wyoming Conference | akira | — | Aug 31, 2023 |
| www.lasaterandmartin.com | abyss | — | Aug 31, 2023 |
| Vivtok | stormous | — | Aug 31, 2023 |
| Rivers Casino | akira | — | Aug 31, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 465 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.