Ransomware attacks in May 2024
535 victims · 55 active groups · 4 new groups · 526 in April 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 535 ransomware victims claimed on leak sites in May 2024, up 1.7% from 526 in April 2024.
- 55 groups posted at least one victim; the three most active groups, lockbit3 (113), ransomhub (55) and play (34), accounted for 37.8% of the total.
- lockbit3 was the most active group with 113 victims, up from 47 in April 2024.
- Business Services was the most-targeted sector with 156 victims (29.2% of the month's total), ahead of Manufacturing (67).
- Organizations in the United States accounted for 257 victims (48.0%), followed by the United Kingdom (34) and Germany (20); 25 victims did not disclose a location.
- 4 groups appeared in HackerFeeds data for the first time this month, including zerotolerance, genesis and arcusmedia.
Daily activity
Busiest day: May 6 (48 victims). Quietest day: May 19 (1 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | April 2024 | Change |
|---|---|---|---|---|---|
| 1 | lockbit3 | 113 | 21.1% | 47 | +66 |
| 2 | ransomhub | 55 | 10.3% | 45 | +10 |
| 3 | play | 34 | 6.4% | 42 | −8 |
| 4 | incransom | 32 | 6.0% | 41 | −9 |
| 5 | medusa | 23 | 4.3% | 26 | −3 |
| 6 | qilin | 21 | 3.9% | 18 | +3 |
| 7 | akira | 21 | 3.9% | 18 | +3 |
| 8 | 8base | 20 | 3.7% | 26 | −6 |
| 9 | blackbasta | 18 | 3.4% | 15 | +3 |
| 10 | dragonforce | 14 | 2.6% | 12 | +2 |
| 11 | bianlian | 14 | 2.6% | 12 | +2 |
| 12 | blacksuit | 13 | 2.4% | 34 | −21 |
| 13 | cactus | 12 | 2.2% | 7 | +5 |
| 14 | arcusmedia | 11 | 2.1% | 0 | +11 |
| 15 | hunters | 10 | 1.9% | 31 | −21 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 156 | 29.2% |
| 2 | Manufacturing | 67 | 12.5% |
| 3 | Technology | 63 | 11.8% |
| 4 | Healthcare | 58 | 10.8% |
| 5 | Transportation/Logistics | 40 | 7.5% |
| 6 | Public Sector | 28 | 5.2% |
| 7 | Financial Services | 26 | 4.9% |
| 8 | Agriculture and Food Production | 23 | 4.3% |
| 9 | Education | 21 | 3.9% |
| 10 | Energy | 12 | 2.2% |
| 11 | Hospitality and Tourism | 11 | 2.1% |
| 12 | Consumer Services | 7 | 1.3% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 257 | 48.0% |
| 2 | United Kingdom | 34 | 6.4% |
| 3 | Germany | 20 | 3.7% |
| 4 | Canada | 20 | 3.7% |
| 5 | Spain | 18 | 3.4% |
| 6 | France | 16 | 3.0% |
| 7 | Italy | 15 | 2.8% |
| 8 | Brazil | 15 | 2.8% |
| 9 | India | 10 | 1.9% |
| 10 | United Arab Emirates | 8 | 1.5% |
| 11 | Mexico | 6 | 1.1% |
| 12 | Japan | 6 | 1.1% |
| 13 | Belgium | 6 | 1.1% |
| 14 | Sweden | 5 | 0.9% |
| 15 | Israel | 5 | 0.9% |
25 victims (4.7%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| zerotolerance | May 5, 2024 |
| genesis | May 7, 2024 |
| arcusmedia | May 8, 2024 |
| madliberator | May 27, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Davis & Young | dragonforce | CA | May 31, 2024 |
| TriLiteral | akira | US | May 31, 2024 |
| New Hampshire PublicRadio | akira | US | May 31, 2024 |
| biremote.net | dragonforce | PR | May 31, 2024 |
| St. Helena | medusa | US | May 31, 2024 |
| keytronic.com | blackbasta | US | May 31, 2024 |
| aloft | incransom | PT | May 31, 2024 |
| aytosanlorenzo.es | lockbit3 | ES | May 30, 2024 |
| strikeusa.com | lockbit3 | US | May 30, 2024 |
| Rob's Whole Health Pharmacy | rhysida | CA | May 30, 2024 |
| www.indigoent.ca | qiulong | CA | May 30, 2024 |
| Sems and Specials | medusa | US | May 30, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 535 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.