All monthly reports
Ransomware attacks in December 2023
546 victims · 44 active groups · 7 new groups · 521 in November 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 546 ransomware victims claimed on leak sites in December 2023, up 4.8% from 521 in November 2023.
- 44 groups posted at least one victim; the three most active groups, toufan (117), lockbit3 (95) and play (38), accounted for 45.8% of the total.
- toufan was the most active group with 117 victims, after posting none in November 2023.
- Manufacturing was the most-targeted sector with 122 victims (22.3% of the month's total), ahead of Business Services (90).
- Organizations in the United States accounted for 103 victims (18.9%), followed by Israel (31) and Canada (19); 251 victims did not disclose a location.
- 7 groups appeared in HackerFeeds data for the first time this month, including interlock, crypto24 and raznatovic.
Daily activity
Busiest day: Dec 19 (115 victims). Quietest day: Dec 31 (0 victims). Victims were posted on 30 of 31 days.
Most active groups
| # | Group | Victims | Share | November 2023 | Change |
|---|---|---|---|---|---|
| 1 | toufan | 117 | 21.4% | 0 | +117 |
| 2 | lockbit3 | 95 | 17.4% | 116 | −21 |
| 3 | play | 38 | 7.0% | 44 | −6 |
| 4 | alphv | 29 | 5.3% | 51 | −22 |
| 5 | blackbasta | 25 | 4.6% | 27 | −2 |
| 6 | 8base | 24 | 4.4% | 34 | −10 |
| 7 | dragonforce | 22 | 4.0% | 0 | +22 |
| 8 | dispossessor | 17 | 3.1% | 15 | +2 |
| 9 | akira | 17 | 3.1% | 20 | −3 |
| 10 | cactus | 12 | 2.2% | 22 | −10 |
| 11 | bianlian | 12 | 2.2% | 13 | −1 |
| 12 | ElDorado | 11 | 2.0% | 3 | +8 |
| 13 | rhysida | 10 | 1.8% | 12 | −2 |
| 14 | cloak | 10 | 1.8% | 0 | +10 |
| 15 | medusa | 9 | 1.6% | 13 | −4 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 122 | 22.3% |
| 2 | Business Services | 90 | 16.5% |
| 3 | Healthcare | 43 | 7.9% |
| 4 | Technology | 37 | 6.8% |
| 5 | Consumer Services | 30 | 5.5% |
| 6 | Education | 28 | 5.1% |
| 7 | Public Sector | 26 | 4.8% |
| 8 | Agriculture and Food Production | 24 | 4.4% |
| 9 | Financial Services | 18 | 3.3% |
| 10 | Transportation/Logistics | 17 | 3.1% |
| 11 | Construction | 17 | 3.1% |
| 12 | Energy | 16 | 2.9% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 103 | 18.9% |
| 2 | Israel | 31 | 5.7% |
| 3 | Canada | 19 | 3.5% |
| 4 | United Kingdom | 16 | 2.9% |
| 5 | Germany | 15 | 2.7% |
| 6 | Australia | 11 | 2.0% |
| 7 | France | 9 | 1.6% |
| 8 | Italy | 7 | 1.3% |
| 9 | Japan | 6 | 1.1% |
| 10 | Singapore | 5 | 0.9% |
| 11 | Netherlands | 4 | 0.7% |
| 12 | Mexico | 4 | 0.7% |
| 13 | Switzerland | 4 | 0.7% |
| 14 | Vietnam | 3 | 0.5% |
| 15 | Luxembourg | 3 | 0.5% |
251 victims (46.0%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Morgan, Chambers & Wright & The Green Group | play | US | Dec 30, 2023 |
| Keyser Mason Ball | play | CA | Dec 30, 2023 |
| Kenya Airways | ransomexx | KE | Dec 30, 2023 |
| brownintegratedlogistics.com | dispossessor | — | Dec 30, 2023 |
| Clearwinds | alphv | — | Dec 30, 2023 |
| contimade.cz | lockbit3 | CZ | Dec 30, 2023 |
| maisonsdelavenir.com | lockbit3 | FR | Dec 30, 2023 |
| Erbilbil Bilgisayar (You have 72 hours) | alphv | — | Dec 29, 2023 |
| Okada Manilla | alphv | PH | Dec 29, 2023 |
| krijnen.be | lockbit3 | BE | Dec 29, 2023 |
| Nej Inc was hacked | alphv | US | Dec 29, 2023 |
| cloudminds.com | lockbit3 | CN | Dec 29, 2023 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 546 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.