Ransomware attacks in September 2024
420 victims · 54 active groups · 4 new groups · 496 in August 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 420 ransomware victims claimed on leak sites in September 2024, down 15.3% from 496 in August 2024.
- 54 groups posted at least one victim; the three most active groups, ransomhub (60), play (45) and qilin (26), accounted for 31.2% of the total.
- ransomhub was the most active group with 60 victims, down from 79 in August 2024.
- Business Services was the most-targeted sector with 119 victims (28.3% of the month's total), ahead of Manufacturing (74).
- Organizations in the United States accounted for 206 victims (49.0%), followed by Canada (26) and the United Kingdom (21).
- 4 groups appeared in HackerFeeds data for the first time this month, including argonauts, orca and ValenciaLeaks.
Daily activity
Busiest day: Sep 23 (38 victims). Quietest day: Sep 21 (0 victims). Victims were posted on 29 of 30 days.
Most active groups
| # | Group | Victims | Share | August 2024 | Change |
|---|---|---|---|---|---|
| 1 | ransomhub | 60 | 14.3% | 79 | −19 |
| 2 | play | 45 | 10.7% | 33 | +12 |
| 3 | qilin | 26 | 6.2% | 23 | +3 |
| 4 | medusa | 26 | 6.2% | 4 | +22 |
| 5 | akira | 21 | 5.0% | 26 | −5 |
| 6 | meow | 18 | 4.3% | 44 | −26 |
| 7 | hunters | 16 | 3.8% | 18 | −2 |
| 8 | ElDorado | 14 | 3.3% | 5 | +9 |
| 9 | killsec | 13 | 3.1% | 15 | −2 |
| 10 | bianlian | 13 | 3.1% | 20 | −7 |
| 11 | 8base | 13 | 3.1% | 0 | +13 |
| 12 | lynx | 11 | 2.6% | 14 | −3 |
| 13 | incransom | 11 | 2.6% | 7 | +4 |
| 14 | blacksuit | 11 | 2.6% | 12 | −1 |
| 15 | rhysida | 9 | 2.1% | 20 | −11 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 119 | 28.3% |
| 2 | Manufacturing | 74 | 17.6% |
| 3 | Technology | 41 | 9.8% |
| 4 | Healthcare | 38 | 9.0% |
| 5 | Financial Services | 25 | 6.0% |
| 6 | Agriculture and Food Production | 25 | 6.0% |
| 7 | Transportation/Logistics | 22 | 5.2% |
| 8 | Hospitality and Tourism | 20 | 4.8% |
| 9 | Education | 17 | 4.0% |
| 10 | Public Sector | 14 | 3.3% |
| 11 | Energy | 8 | 1.9% |
| 12 | Consumer Services | 6 | 1.4% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| argonauts | Sep 15, 2024 |
| orca | Sep 16, 2024 |
| ValenciaLeaks | Sep 18, 2024 |
| frag | Sep 24, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| datacampos.com | ElDorado | BR | Sep 30, 2024 |
| verco.co.uk | threeam | GB | Sep 30, 2024 |
| Community Hospital of Anaconda | meow | US | Sep 30, 2024 |
| Travel Alberta | medusa | CA | Sep 30, 2024 |
| carlile-group.com | threeam | GB | Sep 30, 2024 |
| Lee Hoffoss Injury Lawyers | meow | US | Sep 30, 2024 |
| itap.nacc.go.th | killsec | TH | Sep 30, 2024 |
| TOTVS | blackbyte | BR | Sep 30, 2024 |
| decalesp.com | blacksuit | ES | Sep 30, 2024 |
| Sub-Zero, Wolf, and Cove | medusa | US | Sep 30, 2024 |
| BELL DATA, Inc | medusa | JP | Sep 30, 2024 |
| Isola | medusa | NO | Sep 30, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 420 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.