Ransomware attacks in October 2023
469 victims · 38 active groups · 1 new groups · 512 in September 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 469 ransomware victims claimed on leak sites in October 2023, down 8.4% from 512 in September 2023.
- 38 groups posted at least one victim; the three most active groups, lockbit3 (70), play (50) and noescape (46), accounted for 35.4% of the total.
- lockbit3 was the most active group with 70 victims, down from 76 in September 2023.
- Business Services was the most-targeted sector with 89 victims (19.0% of the month's total), ahead of Manufacturing (71).
- Organizations in the United States accounted for 82 victims (17.5%), followed by the United Kingdom (26) and Canada (16); 209 victims did not disclose a location.
- One group, ElDorado, appeared in HackerFeeds data for the first time this month.
Daily activity
Busiest day: Oct 31 (34 victims). Quietest day: Oct 29 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | September 2023 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 70 | 14.9% | 76 | −6 |
| 2 | play | 50 | 10.7% | 26 | +24 |
| 3 | noescape | 46 | 9.8% | 20 | +26 |
| 4 | alphv | 35 | 7.5% | 52 | −17 |
| 5 | blackbasta | 33 | 7.0% | 3 | +30 |
| 6 | ransomed | 25 | 5.3% | 32 | −7 |
| 7 | 8base | 21 | 4.5% | 21 | 0 |
| 8 | medusa | 20 | 4.3% | 11 | +9 |
| 9 | dispossessor | 17 | 3.6% | 14 | +3 |
| 10 | akira | 17 | 3.6% | 10 | +7 |
| 11 | knight | 16 | 3.4% | 11 | +5 |
| 12 | bianlian | 16 | 3.4% | 24 | −8 |
| 13 | cactus | 12 | 2.6% | 29 | −17 |
| 14 | incransom | 10 | 2.1% | 11 | −1 |
| 15 | monti | 9 | 1.9% | 4 | +5 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 89 | 19.0% |
| 2 | Manufacturing | 71 | 15.1% |
| 3 | Healthcare | 39 | 8.3% |
| 4 | Consumer Services | 32 | 6.8% |
| 5 | Construction | 30 | 6.4% |
| 6 | Education | 27 | 5.8% |
| 7 | Transportation/Logistics | 23 | 4.9% |
| 8 | Public Sector | 22 | 4.7% |
| 9 | Technology | 21 | 4.5% |
| 10 | Agriculture and Food Production | 21 | 4.5% |
| 11 | Financial Services | 17 | 3.6% |
| 12 | Energy | 12 | 2.6% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 82 | 17.5% |
| 2 | United Kingdom | 26 | 5.5% |
| 3 | Canada | 16 | 3.4% |
| 4 | Italy | 15 | 3.2% |
| 5 | France | 11 | 2.3% |
| 6 | Netherlands | 9 | 1.9% |
| 7 | Brazil | 9 | 1.9% |
| 8 | Australia | 9 | 1.9% |
| 9 | Belgium | 7 | 1.5% |
| 10 | Germany | 6 | 1.3% |
| 11 | Iran | 4 | 0.9% |
| 12 | South Africa | 3 | 0.6% |
| 13 | Russia | 3 | 0.6% |
| 14 | Norway | 3 | 0.6% |
| 15 | Mexico | 3 | 0.6% |
209 victims (44.6%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| ElDorado | Oct 19, 2023 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Advarra Inc.(PFIZER,GILEAD ETC AFFECTED) | alphv | — | Oct 31, 2023 |
| Mario de Cecco - Workwear & Corporate Wear IT | knight | — | Oct 31, 2023 |
| Universal Sewing Supply Inc | incransom | US | Oct 31, 2023 |
| Software Systems | medusa | US | Oct 31, 2023 |
| G??P???? S????y??? | play | US | Oct 31, 2023 |
| Patriotisk Selskab | akira | DK | Oct 31, 2023 |
| Auswide Services | bianlian | AU | Oct 31, 2023 |
| B***** | bianlian | — | Oct 31, 2023 |
| Prasan Enterprises | bianlian | US | Oct 31, 2023 |
| riohondo.edu | lockbit3 | US | Oct 31, 2023 |
| utec.com.sa | lockbit3 | SA | Oct 31, 2023 |
| ageroute.sn | lockbit3 | SN | Oct 31, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 469 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.