All monthly reports
Ransomware attacks in February 2024
458 victims · 45 active groups · 7 new groups · 333 in January 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 458 ransomware victims claimed on leak sites in February 2024, up 37.5% from 333 in January 2024.
- 45 groups posted at least one victim; the three most active groups, lockbit3 (105), blackbasta (38) and play (35), accounted for 38.9% of the total.
- lockbit3 was the most active group with 105 victims, up from 75 in January 2024.
- Business Services was the most-targeted sector with 140 victims (30.6% of the month's total), ahead of Manufacturing (63).
- Organizations in the United States accounted for 221 victims (48.3%), followed by the United Kingdom (27) and Canada (21); 3 victims did not disclose a location.
- 7 groups appeared in HackerFeeds data for the first time this month, including darkvault, kraken and trisec.
Daily activity
Busiest day: Feb 12 (41 victims). Quietest day: Feb 3 (4 victims). Victims were posted on 29 of 29 days.
Most active groups
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 140 | 30.6% |
| 2 | Manufacturing | 63 | 13.8% |
| 3 | Technology | 60 | 13.1% |
| 4 | Healthcare | 48 | 10.5% |
| 5 | Transportation/Logistics | 34 | 7.4% |
| 6 | Agriculture and Food Production | 26 | 5.7% |
| 7 | Public Sector | 18 | 3.9% |
| 8 | Financial Services | 15 | 3.3% |
| 9 | Energy | 14 | 3.1% |
| 10 | Hospitality and Tourism | 12 | 2.6% |
| 11 | Education | 11 | 2.4% |
| 12 | Consumer Services | 4 | 0.9% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 221 | 48.3% |
| 2 | United Kingdom | 27 | 5.9% |
| 3 | Canada | 21 | 4.6% |
| 4 | Italy | 18 | 3.9% |
| 5 | Germany | 15 | 3.3% |
| 6 | France | 13 | 2.8% |
| 7 | Spain | 12 | 2.6% |
| 8 | Australia | 9 | 2.0% |
| 9 | Switzerland | 8 | 1.7% |
| 10 | Sweden | 7 | 1.5% |
| 11 | Netherlands | 7 | 1.5% |
| 12 | India | 6 | 1.3% |
| 13 | United Arab Emirates | 6 | 1.3% |
| 14 | Mexico | 5 | 1.1% |
| 15 | Chile | 5 | 1.1% |
3 victims (0.7%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Allan Berger & Associates | alphv | US | Feb 29, 2024 |
| Artissimo Designs | dragonforce | US | Feb 29, 2024 |
| Erwat | dragonforce | ZA | Feb 29, 2024 |
| Faison | dragonforce | US | Feb 29, 2024 |
| Array Networks | dunghill | TW | Feb 29, 2024 |
| Benthanh Group | ransomhub | VN | Feb 29, 2024 |
| sunharbormanor.com | abyss | US | Feb 29, 2024 |
| gapsolutions.com.au | lockbit3 | AU | Feb 29, 2024 |
| BiTec | play | US | Feb 29, 2024 |
| pdq-airspares.co.uk | blackbasta | GB | Feb 29, 2024 |
| keystonetech.com | blackbasta | US | Feb 29, 2024 |
| newagesys.com | cactus | US | Feb 29, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 458 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.