Ransomware attacks in March 2024
480 victims · 42 active groups · 2 new groups · 458 in February 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 480 ransomware victims claimed on leak sites in March 2024, up 4.8% from 458 in February 2024.
- 42 groups posted at least one victim; the three most active groups, lockbit3 (75), play (53) and ransomhub (37), accounted for 34.4% of the total.
- lockbit3 was the most active group with 75 victims, down from 105 in February 2024.
- Business Services was the most-targeted sector with 138 victims (28.8% of the month's total), ahead of Technology (64).
- Organizations in the United States accounted for 239 victims (49.8%), followed by the United Kingdom (27) and Germany (21); 13 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: redransomware and dAn0n.
Daily activity
Busiest day: Mar 6 (47 victims). Quietest day: Mar 10 (1 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | February 2024 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 75 | 15.6% | 105 | −30 |
| 2 | play | 53 | 11.0% | 35 | +18 |
| 3 | ransomhub | 37 | 7.7% | 8 | +29 |
| 4 | blackbasta | 34 | 7.1% | 38 | −4 |
| 5 | medusa | 27 | 5.6% | 14 | +13 |
| 6 | raworld | 21 | 4.4% | 0 | +21 |
| 7 | hunters | 18 | 3.8% | 33 | −15 |
| 8 | akira | 18 | 3.8% | 17 | +1 |
| 9 | bianlian | 17 | 3.5% | 21 | −4 |
| 10 | incransom | 13 | 2.7% | 4 | +9 |
| 11 | 8base | 13 | 2.7% | 21 | −8 |
| 12 | redransomware | 12 | 2.5% | 0 | +12 |
| 13 | stormous | 10 | 2.1% | 7 | +3 |
| 14 | qilin | 10 | 2.1% | 14 | −4 |
| 15 | blacksuit | 9 | 1.9% | 5 | +4 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 138 | 28.8% |
| 2 | Technology | 64 | 13.3% |
| 3 | Manufacturing | 60 | 12.5% |
| 4 | Healthcare | 60 | 12.5% |
| 5 | Transportation/Logistics | 24 | 5.0% |
| 6 | Financial Services | 24 | 5.0% |
| 7 | Agriculture and Food Production | 23 | 4.8% |
| 8 | Education | 17 | 3.5% |
| 9 | Public Sector | 14 | 2.9% |
| 10 | Hospitality and Tourism | 13 | 2.7% |
| 11 | Energy | 13 | 2.7% |
| 12 | Construction | 7 | 1.5% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| redransomware | Mar 5, 2024 |
| dAn0n | Mar 26, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| rjcorp.in | lockbit3 | IN | Mar 31, 2024 |
| cmactrans.com | blackbasta | US | Mar 31, 2024 |
| Pavilion Construction LLC | bianlian | US | Mar 30, 2024 |
| Claro | trigona | MX | Mar 30, 2024 |
| theblakefirm.com | dAn0n | US | Mar 30, 2024 |
| fightingforfairness.com | dAn0n | US | Mar 30, 2024 |
| The Blake Law Firm | dAn0n | US | Mar 30, 2024 |
| RSH legal | dAn0n | US | Mar 30, 2024 |
| W?????? ????????y | play | US | Mar 29, 2024 |
| eni.com&mellitahog.ly | ransomhub | IT | Mar 29, 2024 |
| Control Technology | akira | US | Mar 29, 2024 |
| Williams County Abstract Company | medusa | US | Mar 29, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 480 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.