Ransomware attacks in January 2024
333 victims · 42 active groups · 4 new groups · 546 in December 2023 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 333 ransomware victims claimed on leak sites in January 2024, down 39.0% from 546 in December 2023.
- 42 groups posted at least one victim; the three most active groups, lockbit3 (75), 8base (35) and akira (26), accounted for 40.8% of the total.
- lockbit3 was the most active group with 75 victims, down from 95 in December 2023.
- Business Services was the most-targeted sector with 115 victims (34.5% of the month's total), ahead of Manufacturing (42).
- Organizations in the United States accounted for 176 victims (52.9%), followed by France (17) and Canada (16).
- 4 groups appeared in HackerFeeds data for the first time this month, including slug, insane and radar.
Daily activity
Busiest day: Jan 24 (28 victims). Quietest day: Jan 13 (1 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | December 2023 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 75 | 22.5% | 95 | −20 |
| 2 | 8base | 35 | 10.5% | 24 | +11 |
| 3 | akira | 26 | 7.8% | 17 | +9 |
| 4 | alphv | 22 | 6.6% | 29 | −7 |
| 5 | play | 19 | 5.7% | 38 | −19 |
| 6 | bianlian | 17 | 5.1% | 12 | +5 |
| 7 | hunters | 14 | 4.2% | 6 | +8 |
| 8 | cactus | 13 | 3.9% | 12 | +1 |
| 9 | trigona | 11 | 3.3% | 0 | +11 |
| 10 | qilin | 11 | 3.3% | 7 | +4 |
| 11 | medusa | 11 | 3.3% | 9 | +2 |
| 12 | incransom | 9 | 2.7% | 7 | +2 |
| 13 | alphalocker | 7 | 2.1% | 0 | +7 |
| 14 | blackbasta | 6 | 1.8% | 25 | −19 |
| 15 | snatch | 5 | 1.5% | 3 | +2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 115 | 34.5% |
| 2 | Manufacturing | 42 | 12.6% |
| 3 | Healthcare | 32 | 9.6% |
| 4 | Technology | 31 | 9.3% |
| 5 | Transportation/Logistics | 24 | 7.2% |
| 6 | Education | 20 | 6.0% |
| 7 | Agriculture and Food Production | 16 | 4.8% |
| 8 | Public Sector | 15 | 4.5% |
| 9 | Financial Services | 14 | 4.2% |
| 10 | Energy | 9 | 2.7% |
| 11 | Hospitality and Tourism | 7 | 2.1% |
| 12 | Consumer Services | 4 | 1.2% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| slug | Jan 15, 2024 |
| insane | Jan 17, 2024 |
| radar | Jan 22, 2024 |
| alphalocker | Jan 24, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| apeagers.au | lockbit3 | NZ | Jan 31, 2024 |
| Hydraflow | alphv | US | Jan 31, 2024 |
| SportsMEDIA Technology | alphv | US | Jan 31, 2024 |
| Galaxy Fireworks, Inc | medusa | US | Jan 31, 2024 |
| Sefin | akira | IT | Jan 31, 2024 |
| North Hill | blacksuit | US | Jan 31, 2024 |
| mnorch.org | lockbit3 | US | Jan 31, 2024 |
| mrm.com.mx | lockbit3 | MX | Jan 31, 2024 |
| sahchicago.org | lockbit3 | US | Jan 31, 2024 |
| mutualclubunion.com.ar | lockbit3 | AR | Jan 31, 2024 |
| rfca.com | lockbit3 | US | Jan 31, 2024 |
| elezabypharmacy.com | lockbit3 | EG | Jan 31, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 333 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.