Ransomware attacks in July 2024
447 victims · 55 active groups · 4 new groups · 369 in June 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 447 ransomware victims claimed on leak sites in July 2024, up 21.1% from 369 in June 2024.
- 55 groups posted at least one victim; the three most active groups, ransomhub (58), lockbit3 (30) and akira (30), accounted for 26.4% of the total.
- ransomhub was the most active group with 58 victims, up from 37 in June 2024.
- Business Services was the most-targeted sector with 128 victims (28.6% of the month's total), ahead of Technology (66).
- Organizations in the United States accounted for 199 victims (44.5%), followed by Canada (19) and the United Kingdom (18); 63 victims did not disclose a location.
- 4 groups appeared in HackerFeeds data for the first time this month, including BrainCipher, sarcoma and vanirgroup.
Daily activity
Busiest day: Jul 16 (43 victims). Quietest day: Jul 6 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | June 2024 | Change |
|---|---|---|---|---|---|
| 1 | ransomhub | 58 | 13.0% | 37 | +21 |
| 2 | lockbit3 | 30 | 6.7% | 19 | +11 |
| 3 | akira | 30 | 6.7% | 27 | +3 |
| 4 | hunters | 29 | 6.5% | 8 | +21 |
| 5 | qilin | 18 | 4.0% | 20 | −2 |
| 6 | medusa | 18 | 4.0% | 17 | +1 |
| 7 | meow | 17 | 3.8% | 2 | +15 |
| 8 | play | 15 | 3.4% | 30 | −15 |
| 9 | dragonforce | 14 | 3.1% | 7 | +7 |
| 10 | cactus | 14 | 3.1% | 7 | +7 |
| 11 | blacksuit | 14 | 3.1% | 19 | −5 |
| 12 | bianlian | 13 | 2.9% | 9 | +4 |
| 13 | incransom | 12 | 2.7% | 18 | −6 |
| 14 | rhysida | 11 | 2.5% | 6 | +5 |
| 15 | lynx | 11 | 2.5% | 1 | +10 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 128 | 28.6% |
| 2 | Technology | 66 | 14.8% |
| 3 | Healthcare | 55 | 12.3% |
| 4 | Manufacturing | 54 | 12.1% |
| 5 | Education | 23 | 5.1% |
| 6 | Public Sector | 21 | 4.7% |
| 7 | Transportation/Logistics | 19 | 4.3% |
| 8 | Hospitality and Tourism | 16 | 3.6% |
| 9 | Financial Services | 15 | 3.4% |
| 10 | Agriculture and Food Production | 15 | 3.4% |
| 11 | Energy | 12 | 2.7% |
| 12 | Consumer Services | 4 | 0.9% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 199 | 44.5% |
| 2 | Canada | 19 | 4.3% |
| 3 | United Kingdom | 18 | 4.0% |
| 4 | Germany | 13 | 2.9% |
| 5 | Brazil | 11 | 2.5% |
| 6 | Australia | 9 | 2.0% |
| 7 | Italy | 8 | 1.8% |
| 8 | Spain | 8 | 1.8% |
| 9 | India | 7 | 1.6% |
| 10 | France | 6 | 1.3% |
| 11 | Belgium | 6 | 1.3% |
| 12 | South Africa | 5 | 1.1% |
| 13 | Singapore | 5 | 1.1% |
| 14 | Netherlands | 5 | 1.1% |
| 15 | Indonesia | 4 | 0.9% |
63 victims (14.1%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| BrainCipher | Jul 1, 2024 |
| sarcoma | Jul 9, 2024 |
| vanirgroup | Jul 10, 2024 |
| ransomcortex | Jul 12, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| fingersstore.com | killsec | IN | Jul 31, 2024 |
| Find Great People | akira | US | Jul 31, 2024 |
| www.pharm-int.com | ransomhub | US | Jul 31, 2024 |
| nydj.com | ransomhub | US | Jul 31, 2024 |
| biggreenegg.com | ransomhub | US | Jul 31, 2024 |
| wgma.org | ransomhub | US | Jul 31, 2024 |
| Carlex Glass Luxembourg S.A. | metaencryptor | LU | Jul 31, 2024 |
| Florence Cement Company, Inc. | bianlian | US | Jul 31, 2024 |
| Sable International. | bianlian | GB | Jul 31, 2024 |
| BRASPRESS | akira | BR | Jul 31, 2024 |
| Durham Manufacturing | hunters | US | Jul 31, 2024 |
| Kleven Construction | hunters | US | Jul 31, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 447 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.