Ransomware attacks in October 2024
645 victims · 55 active groups · 3 new groups · 420 in September 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 645 ransomware victims claimed on leak sites in October 2024, up 53.6% from 420 in September 2024.
- 55 groups posted at least one victim; the three most active groups, ransomhub (91), play (49) and killsec (33), accounted for 26.8% of the total.
- ransomhub was the most active group with 91 victims, up from 60 in September 2024.
- Business Services was the most-targeted sector with 181 victims (28.1% of the month's total), ahead of Manufacturing (101).
- Organizations in the United States accounted for 307 victims (47.6%), followed by Canada (39) and India (31); 9 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: dragonransomware, hellcat and playboy.
Daily activity
Busiest day: Oct 25 (50 victims). Quietest day: Oct 13 (5 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | September 2024 | Change |
|---|---|---|---|---|---|
| 1 | ransomhub | 91 | 14.1% | 60 | +31 |
| 2 | play | 49 | 7.6% | 45 | +4 |
| 3 | killsec | 33 | 5.1% | 13 | +20 |
| 4 | blackbasta | 32 | 5.0% | 2 | +30 |
| 5 | sarcoma | 29 | 4.5% | 1 | +28 |
| 6 | qilin | 26 | 4.0% | 26 | 0 |
| 7 | hunters | 26 | 4.0% | 16 | +10 |
| 8 | meow | 25 | 3.9% | 18 | +7 |
| 9 | fog | 24 | 3.7% | 5 | +19 |
| 10 | lynx | 22 | 3.4% | 11 | +11 |
| 11 | blacksuit | 21 | 3.3% | 11 | +10 |
| 12 | apt73 | 21 | 3.3% | 1 | +20 |
| 13 | akira | 19 | 2.9% | 21 | −2 |
| 14 | medusa | 17 | 2.6% | 26 | −9 |
| 15 | safepay | 15 | 2.3% | 6 | +9 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 181 | 28.1% |
| 2 | Manufacturing | 101 | 15.7% |
| 3 | Technology | 85 | 13.2% |
| 4 | Healthcare | 68 | 10.5% |
| 5 | Transportation/Logistics | 31 | 4.8% |
| 6 | Public Sector | 30 | 4.7% |
| 7 | Financial Services | 29 | 4.5% |
| 8 | Education | 29 | 4.5% |
| 9 | Hospitality and Tourism | 20 | 3.1% |
| 10 | Agriculture and Food Production | 20 | 3.1% |
| 11 | Energy | 16 | 2.5% |
| 12 | Consumer Services | 11 | 1.7% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 307 | 47.6% |
| 2 | Canada | 39 | 6.0% |
| 3 | India | 31 | 4.8% |
| 4 | United Kingdom | 29 | 4.5% |
| 5 | Italy | 18 | 2.8% |
| 6 | Germany | 18 | 2.8% |
| 7 | Brazil | 15 | 2.3% |
| 8 | France | 14 | 2.2% |
| 9 | Australia | 14 | 2.2% |
| 10 | Spain | 13 | 2.0% |
| 11 | Israel | 12 | 1.9% |
| 12 | Switzerland | 8 | 1.2% |
| 13 | Japan | 7 | 1.1% |
| 14 | United Arab Emirates | 7 | 1.1% |
| 15 | Mexico | 6 | 0.9% |
9 victims (1.4%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| dragonransomware | Oct 22, 2024 |
| hellcat | Oct 25, 2024 |
| playboy | Oct 28, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| shambhaviayurveda.in | dragonransomware | IN | Oct 31, 2024 |
| www.d47.org | ransomhub | US | Oct 31, 2024 |
| Houston Housing Authority | meow | US | Oct 31, 2024 |
| inhometexas.com | threeam | US | Oct 31, 2024 |
| BULLONERIE GALVIT | raworld | IT | Oct 31, 2024 |
| Brancaia | sarcoma | IT | Oct 31, 2024 |
| TDM Technical Services | sarcoma | CA | Oct 31, 2024 |
| CAS Software | sarcoma | DE | Oct 31, 2024 |
| Transak.com | stormous | GB | Oct 31, 2024 |
| Smitty's Supply | play | US | Oct 31, 2024 |
| bender.de | blackbasta | DE | Oct 31, 2024 |
| beko-technologies.com | blackbasta | DE | Oct 31, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 645 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.