All monthly reports
Ransomware attacks in November 2023
521 victims · 42 active groups · 4 new groups · 469 in October 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 521 ransomware victims claimed on leak sites in November 2023, up 11.1% from 469 in October 2023.
- 42 groups posted at least one victim; the three most active groups, lockbit3 (116), alphv (51) and play (44), accounted for 40.5% of the total.
- lockbit3 was the most active group with 116 victims, up from 70 in October 2023.
- Business Services was the most-targeted sector with 94 victims (18.0% of the month's total), ahead of Manufacturing (88).
- Organizations in the United States accounted for 102 victims (19.6%), followed by the United Kingdom (22) and Germany (20); 239 victims did not disclose a location.
- 4 groups appeared in HackerFeeds data for the first time this month, including apt73, safepay and siegedsec.
Daily activity
Busiest day: Nov 5 (37 victims). Quietest day: Nov 4 (3 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | October 2023 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 116 | 22.3% | 70 | +46 |
| 2 | alphv | 51 | 9.8% | 35 | +16 |
| 3 | play | 44 | 8.4% | 50 | −6 |
| 4 | 8base | 34 | 6.5% | 21 | +13 |
| 5 | blackbasta | 27 | 5.2% | 33 | −6 |
| 6 | cactus | 22 | 4.2% | 12 | +10 |
| 7 | akira | 20 | 3.8% | 17 | +3 |
| 8 | hunters | 17 | 3.3% | 2 | +15 |
| 9 | incransom | 15 | 2.9% | 10 | +5 |
| 10 | dispossessor | 15 | 2.9% | 17 | −2 |
| 11 | noescape | 14 | 2.7% | 46 | −32 |
| 12 | medusa | 13 | 2.5% | 20 | −7 |
| 13 | bianlian | 13 | 2.5% | 16 | −3 |
| 14 | rhysida | 12 | 2.3% | 5 | +7 |
| 15 | siegedsec | 11 | 2.1% | 0 | +11 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 94 | 18.0% |
| 2 | Manufacturing | 88 | 16.9% |
| 3 | Healthcare | 43 | 8.3% |
| 4 | Consumer Services | 43 | 8.3% |
| 5 | Construction | 32 | 6.1% |
| 6 | Agriculture and Food Production | 29 | 5.6% |
| 7 | Financial Services | 26 | 5.0% |
| 8 | Transportation/Logistics | 25 | 4.8% |
| 9 | Technology | 25 | 4.8% |
| 10 | Education | 24 | 4.6% |
| 11 | Public Sector | 21 | 4.0% |
| 12 | Energy | 13 | 2.5% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 102 | 19.6% |
| 2 | United Kingdom | 22 | 4.2% |
| 3 | Germany | 20 | 3.8% |
| 4 | Canada | 15 | 2.9% |
| 5 | Italy | 14 | 2.7% |
| 6 | France | 11 | 2.1% |
| 7 | Spain | 9 | 1.7% |
| 8 | Brazil | 8 | 1.5% |
| 9 | Australia | 8 | 1.5% |
| 10 | Malaysia | 5 | 1.0% |
| 11 | India | 5 | 1.0% |
| 12 | Taiwan | 4 | 0.8% |
| 13 | Denmark | 4 | 0.8% |
| 14 | Thailand | 3 | 0.6% |
| 15 | Philippines | 3 | 0.6% |
239 victims (45.9%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| HTC Global Services | alphv | — | Nov 30, 2023 |
| Rudolf GmbH & Rudolf Venture Chemicals Inc - Press Release | monti | — | Nov 30, 2023 |
| Bauwerk Boen Group | akira | — | Nov 30, 2023 |
| A**** *********** Inc | bianlian | — | Nov 30, 2023 |
| Covenant Care | hunters | US | Nov 30, 2023 |
| FUTURA Fundamentsysteme was hacked | knight | DE | Nov 30, 2023 |
| Contitec Empresarial | knight | BR | Nov 30, 2023 |
| Wakefield & Associates | akira | US | Nov 30, 2023 |
| Wakefield & Associates | coinbasecartel | US | Nov 30, 2023 |
| Wakefield & Associates | knight | US | Nov 30, 2023 |
| DePauw University | blacksuit | IN | Nov 30, 2023 |
| aurobindousa.com | abyss | — | Nov 30, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 521 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.