Ransomware attacks in September 2023

512 victims · 44 active groups · 5 new groups · 465 in August 2023 · Updated Oct 14, 2026

Key findings

HackerFeeds recorded 512 ransomware victims claimed on leak sites in September 2023, up 10.1% from 465 in August 2023.
44 groups posted at least one victim; the three most active groups, lockbit3 (76), losttrust (53) and alphv (52), accounted for 35.4% of the total.
lockbit3 was the most active group with 76 victims, down from 125 in August 2023.
Business Services was the most-targeted sector with 81 victims (15.8% of the month's total), ahead of Manufacturing (64).
Organizations in the United States accounted for 55 victims (10.7%), followed by the United Kingdom (16) and Bulgaria (16); 294 victims did not disclose a location.
5 groups appeared in HackerFeeds data for the first time this month, including meow, knight and noname.

Daily activity

Busiest day: Sep 26 (89 victims). Quietest day: Sep 17 (4 victims). Victims were posted on 30 of 30 days.

Most active groups

#	Group	Victims	Share	August 2023	Change
1	lockbit3	76	14.8%	125	−49
2	losttrust	53	10.4%	0	+53
3	alphv	52	10.2%	43	+9
4	ransomed	32	6.3%	11	+21
5	cactus	29	5.7%	9	+20
6	play	26	5.1%	22	+4
7	bianlian	24	4.7%	12	+12
8	8base	21	4.1%	34	−13
9	noescape	20	3.9%	22	−2
10	ragnarlocker	14	2.7%	1	+13
11	dispossessor	14	2.7%	32	−18
12	medusa	11	2.1%	12	−1
13	knight	11	2.1%	0	+11
14	incransom	11	2.1%	3	+8
15	akira	10	2.0%	30	−20

Targeted sectors

#	Sector	Victims	Share of month
1	Business Services	81	15.8%
2	Manufacturing	64	12.5%
3	Technology	49	9.6%
4	Healthcare	42	8.2%
5	Consumer Services	41	8.0%
6	Construction	37	7.2%
7	Financial Services	29	5.7%
8	Agriculture and Food Production	27	5.3%
9	Education	25	4.9%
10	Transportation/Logistics	22	4.3%
11	Public Sector	22	4.3%
12	Hospitality and Tourism	19	3.7%

Countries

#	Country	Victims	Share of month
1	United States	55	10.7%
2	United Kingdom	16	3.1%
3	Bulgaria	16	3.1%
4	Germany	15	2.9%
5	Australia	12	2.3%
6	Canada	10	2.0%
7	Brazil	9	1.8%
8	France	8	1.6%
9	Mexico	6	1.2%
10	Italy	6	1.2%
11	Russia	5	1.0%
12	Japan	4	0.8%
13	Belgium	4	0.8%
14	Turkey	3	0.6%
15	Netherlands	3	0.6%

294 victims (57.4%) did not disclose a location.

Groups seen for the first time

Group	First victim
meow	Sep 4, 2023
knight	Sep 6, 2023
noname	Sep 11, 2023
ciphbit	Sep 14, 2023
losttrust	Sep 26, 2023

“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.

Latest victims of the month

Victim	Group	Country	Date
Astre - Leaked	ragnarlocker	—	Sep 30, 2023
Network Pacific Real Estate - Leak	ragnarlocker	—	Sep 30, 2023
roomhotel-sochi.ru	werewolves	RU	Sep 30, 2023
LEAKED! Motel One	alphv	—	Sep 30, 2023
Motel One	alphv	—	Sep 30, 2023
MNGI Digestive Health (TIME IS UP)	alphv	—	Sep 30, 2023
Van Oirschot	ransomhouse	BE	Sep 30, 2023
UPDATED: INC RANSOMWARE...	donutleaks	—	Sep 30, 2023
INC RANSOMWARE...	donutleaks	—	Sep 30, 2023
mclaren health care	alphv	US	Sep 29, 2023
Garn Mason Orthodontics was hacked. All insurance and personal data of customers was stole	knight	—	Sep 29, 2023
solveindustrial.com	lockbit3	—	Sep 29, 2023

Methodology

Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 512 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.