Ransomware attacks in April 2024
526 victims · 51 active groups · 8 new groups · 480 in March 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 526 ransomware victims claimed on leak sites in April 2024, up 9.6% from 480 in March 2024.
- 51 groups posted at least one victim; the three most active groups, lockbit3 (47), ransomhub (45) and play (42), accounted for 25.5% of the total.
- lockbit3 was the most active group with 47 victims, down from 75 in March 2024.
- Business Services was the most-targeted sector with 156 victims (29.7% of the month's total), ahead of Technology (83).
- Organizations in the United States accounted for 250 victims (47.5%), followed by Canada (24) and Germany (22); 34 victims did not disclose a location.
- 8 groups appeared in HackerFeeds data for the first time this month, including handala, embargo and hellogookie.
Daily activity
Busiest day: Apr 19 (41 victims). Quietest day: Apr 21 (1 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | March 2024 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 47 | 8.9% | 75 | −28 |
| 2 | ransomhub | 45 | 8.6% | 37 | +8 |
| 3 | play | 42 | 8.0% | 53 | −11 |
| 4 | incransom | 41 | 7.8% | 13 | +28 |
| 5 | blacksuit | 34 | 6.5% | 9 | +25 |
| 6 | hunters | 31 | 5.9% | 18 | +13 |
| 7 | medusa | 26 | 4.9% | 27 | −1 |
| 8 | 8base | 26 | 4.9% | 13 | +13 |
| 9 | dispossessor | 21 | 4.0% | 5 | +16 |
| 10 | raworld | 19 | 3.6% | 21 | −2 |
| 11 | qilin | 18 | 3.4% | 10 | +8 |
| 12 | akira | 18 | 3.4% | 18 | 0 |
| 13 | blackbasta | 15 | 2.9% | 34 | −19 |
| 14 | dragonforce | 12 | 2.3% | 6 | +6 |
| 15 | bianlian | 12 | 2.3% | 17 | −5 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 156 | 29.7% |
| 2 | Technology | 83 | 15.8% |
| 3 | Manufacturing | 70 | 13.3% |
| 4 | Healthcare | 57 | 10.8% |
| 5 | Financial Services | 27 | 5.1% |
| 6 | Transportation/Logistics | 22 | 4.2% |
| 7 | Public Sector | 22 | 4.2% |
| 8 | Agriculture and Food Production | 21 | 4.0% |
| 9 | Energy | 18 | 3.4% |
| 10 | Hospitality and Tourism | 17 | 3.2% |
| 11 | Education | 13 | 2.5% |
| 12 | Construction | 3 | 0.6% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 250 | 47.5% |
| 2 | Canada | 24 | 4.6% |
| 3 | Germany | 22 | 4.2% |
| 4 | United Kingdom | 20 | 3.8% |
| 5 | Italy | 18 | 3.4% |
| 6 | Brazil | 16 | 3.0% |
| 7 | India | 15 | 2.9% |
| 8 | Australia | 14 | 2.7% |
| 9 | France | 13 | 2.5% |
| 10 | Spain | 12 | 2.3% |
| 11 | Israel | 8 | 1.5% |
| 12 | Switzerland | 6 | 1.1% |
| 13 | El Salvador | 4 | 0.8% |
| 14 | Netherlands | 4 | 0.8% |
| 15 | Ireland | 4 | 0.8% |
34 victims (6.5%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| handala | Apr 5, 2024 |
| embargo | Apr 17, 2024 |
| hellogookie | Apr 19, 2024 |
| qiulong | Apr 19, 2024 |
| shinyhunters | Apr 23, 2024 |
| flocker | Apr 25, 2024 |
| spacebears | Apr 25, 2024 |
| apos | Apr 26, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Sobieski Services Inc | incransom | US | Apr 30, 2024 |
| Trylon Srl | incransom | RO | Apr 30, 2024 |
| Woodfords Family Services | medusa | US | Apr 30, 2024 |
| MyoVision | medusa | US | Apr 30, 2024 |
| S.A. Piazza & Associates | medusa | US | Apr 30, 2024 |
| It4 Solutions Robras Corp | incransom | US | Apr 30, 2024 |
| Lewis Brothers Bakeries | medusa | US | Apr 30, 2024 |
| GCH Hotel Group | akira | DE | Apr 30, 2024 |
| tudio Libeskind | akira | US | Apr 30, 2024 |
| firstmac.com.au | embargo | AU | Apr 30, 2024 |
| C?????l I????????s | play | CA | Apr 30, 2024 |
| sbsofbak.com | lockbit3 | US | Apr 30, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 526 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.