Ransomware attacks in June 2024
369 victims · 54 active groups · 6 new groups · 535 in May 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 369 ransomware victims claimed on leak sites in June 2024, down 31.0% from 535 in May 2024.
- 54 groups posted at least one victim; the three most active groups, ransomhub (37), play (30) and akira (27), accounted for 25.5% of the total.
- ransomhub was the most active group with 37 victims, down from 55 in May 2024.
- Business Services was the most-targeted sector with 114 victims (30.9% of the month's total), ahead of Technology (58).
- Organizations in the United States accounted for 175 victims (47.4%), followed by the United Kingdom (23) and Canada (18); 22 victims did not disclose a location.
- 6 groups appeared in HackerFeeds data for the first time this month, including cicada3301, sensayq and trinity.
Daily activity
Busiest day: Jun 12 (19 victims). Quietest day: Jun 9 (3 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | May 2024 | Change |
|---|---|---|---|---|---|
| 1 | ransomhub | 37 | 10.0% | 55 | −18 |
| 2 | play | 30 | 8.1% | 34 | −4 |
| 3 | akira | 27 | 7.3% | 21 | +6 |
| 4 | qilin | 20 | 5.4% | 21 | −1 |
| 5 | lockbit3 | 19 | 5.1% | 113 | −94 |
| 6 | blacksuit | 19 | 5.1% | 13 | +6 |
| 7 | incransom | 18 | 4.9% | 32 | −14 |
| 8 | medusa | 17 | 4.6% | 23 | −6 |
| 9 | arcusmedia | 16 | 4.3% | 11 | +5 |
| 10 | blackbasta | 11 | 3.0% | 18 | −7 |
| 11 | darkvault | 10 | 2.7% | 3 | +7 |
| 12 | bianlian | 9 | 2.4% | 14 | −5 |
| 13 | 8base | 9 | 2.4% | 20 | −11 |
| 14 | ransomhouse | 8 | 2.2% | 5 | +3 |
| 15 | hunters | 8 | 2.2% | 10 | −2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 114 | 30.9% |
| 2 | Technology | 58 | 15.7% |
| 3 | Healthcare | 48 | 13.0% |
| 4 | Manufacturing | 37 | 10.0% |
| 5 | Transportation/Logistics | 23 | 6.2% |
| 6 | Financial Services | 13 | 3.5% |
| 7 | Public Sector | 12 | 3.3% |
| 8 | Education | 12 | 3.3% |
| 9 | Agriculture and Food Production | 12 | 3.3% |
| 10 | Energy | 11 | 3.0% |
| 11 | Hospitality and Tourism | 9 | 2.4% |
| 12 | Consumer Services | 7 | 1.9% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 175 | 47.4% |
| 2 | United Kingdom | 23 | 6.2% |
| 3 | Canada | 18 | 4.9% |
| 4 | Italy | 12 | 3.3% |
| 5 | Germany | 12 | 3.3% |
| 6 | Australia | 10 | 2.7% |
| 7 | India | 8 | 2.2% |
| 8 | Spain | 7 | 1.9% |
| 9 | Brazil | 7 | 1.9% |
| 10 | Japan | 5 | 1.4% |
| 11 | France | 5 | 1.4% |
| 12 | New Zealand | 3 | 0.8% |
| 13 | Israel | 3 | 0.8% |
| 14 | Denmark | 3 | 0.8% |
| 15 | China | 3 | 0.8% |
22 victims (6.0%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| cicada3301 | Jun 4, 2024 |
| sensayq | Jun 4, 2024 |
| trinity | Jun 6, 2024 |
| RunSomeWares | Jun 22, 2024 |
| datacarry | Jun 26, 2024 |
| kairos | Jun 26, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| P********.pl | cloak | PL | Jun 30, 2024 |
| Unit*****************.com | cloak | US | Jun 30, 2024 |
| Wayne Memorial Hospital | monti | US | Jun 30, 2024 |
| lambertz.de | blackbasta | DE | Jun 30, 2024 |
| alconca.com.ve | lockbit3 | VE | Jun 30, 2024 |
| RiverSoft | ransomhouse | US | Jun 30, 2024 |
| HITC.VN | stormous | VN | Jun 30, 2024 |
| DRM Resources | rhysida | US | Jun 29, 2024 |
| www.hauptmann.at | ransomhub | AT | Jun 29, 2024 |
| www.finecopneumatica.com | ransomhub | IT | Jun 29, 2024 |
| Freightliner of Grand Rapids & Kalamazoo | arcusmedia | US | Jun 29, 2024 |
| DatAnalítica | arcusmedia | DM | Jun 29, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 369 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.