All monthly reports
Ransomware attacks in August 2024
496 victims · 49 active groups · 2 new groups · 447 in July 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 496 ransomware victims claimed on leak sites in August 2024, up 11.0% from 447 in July 2024.
- 49 groups posted at least one victim; the three most active groups, ransomhub (79), meow (44) and play (33), accounted for 31.5% of the total.
- ransomhub was the most active group with 79 victims, up from 58 in July 2024.
- Business Services was the most-targeted sector with 159 victims (32.1% of the month's total), ahead of Technology (66).
- Organizations in the United States accounted for 232 victims (46.8%), followed by the United Kingdom (30) and Canada (23); 6 victims did not disclose a location.
- 2 groups appeared in HackerFeeds data for the first time this month: helldown and lockbit5.
Daily activity
Busiest day: Aug 22 (34 victims). Quietest day: Aug 4 (4 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | July 2024 | Change |
|---|---|---|---|---|---|
| 1 | ransomhub | 79 | 15.9% | 58 | +21 |
| 2 | meow | 44 | 8.9% | 17 | +27 |
| 3 | play | 33 | 6.7% | 15 | +18 |
| 4 | akira | 26 | 5.2% | 30 | −4 |
| 5 | qilin | 23 | 4.6% | 18 | +5 |
| 6 | helldown | 21 | 4.2% | 0 | +21 |
| 7 | rhysida | 20 | 4.0% | 11 | +9 |
| 8 | bianlian | 20 | 4.0% | 13 | +7 |
| 9 | hunters | 18 | 3.6% | 29 | −11 |
| 10 | killsec | 15 | 3.0% | 3 | +12 |
| 11 | lynx | 14 | 2.8% | 11 | +3 |
| 12 | cicada3301 | 14 | 2.8% | 8 | +6 |
| 13 | monti | 13 | 2.6% | 3 | +10 |
| 14 | lockbit3 | 13 | 2.6% | 30 | −17 |
| 15 | dragonforce | 12 | 2.4% | 14 | −2 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 159 | 32.1% |
| 2 | Technology | 66 | 13.3% |
| 3 | Manufacturing | 63 | 12.7% |
| 4 | Healthcare | 40 | 8.1% |
| 5 | Agriculture and Food Production | 30 | 6.0% |
| 6 | Financial Services | 29 | 5.8% |
| 7 | Transportation/Logistics | 23 | 4.6% |
| 8 | Public Sector | 21 | 4.2% |
| 9 | Education | 15 | 3.0% |
| 10 | Hospitality and Tourism | 13 | 2.6% |
| 11 | Energy | 13 | 2.6% |
| 12 | Consumer Services | 7 | 1.4% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 232 | 46.8% |
| 2 | United Kingdom | 30 | 6.0% |
| 3 | Canada | 23 | 4.6% |
| 4 | Italy | 18 | 3.6% |
| 5 | Germany | 14 | 2.8% |
| 6 | India | 12 | 2.4% |
| 7 | France | 12 | 2.4% |
| 8 | Australia | 11 | 2.2% |
| 9 | Brazil | 8 | 1.6% |
| 10 | Poland | 7 | 1.4% |
| 11 | Israel | 7 | 1.4% |
| 12 | Spain | 7 | 1.4% |
| 13 | Switzerland | 7 | 1.4% |
| 14 | South Africa | 5 | 1.0% |
| 15 | Sweden | 5 | 1.0% |
6 victims (1.2%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Caseificio Alta Valsesia | meow | IT | Aug 31, 2024 |
| White Mountain Backpacks | rhysida | AU | Aug 31, 2024 |
| Donco and Sons Inc. | meow | US | Aug 31, 2024 |
| Grupo Modesto Cerqueira | meow | BR | Aug 31, 2024 |
| NOBI AS | meow | NO | Aug 31, 2024 |
| Instituto Cardiovascular del Cesar | meow | CO | Aug 31, 2024 |
| Special Oilfield Services Company LLC | meow | OM | Aug 31, 2024 |
| www.nissan-dubai.com | ransomhub | AE | Aug 31, 2024 |
| The Recycler Core Company | ElDorado | US | Aug 31, 2024 |
| Sports & Spine Orthopaedics | rhysida | US | Aug 31, 2024 |
| Mitsubishi Chemical Group | everest | JP | Aug 31, 2024 |
| KW Realty Group | qilin | US | Aug 31, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 496 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.