Ransomware attacks in November 2024
629 victims · 57 active groups · 1 new groups · 645 in October 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 629 ransomware victims claimed on leak sites in November 2024, down 2.5% from 645 in October 2024.
- 57 groups posted at least one victim; the three most active groups, ransomhub (100), akira (44) and killsec (33), accounted for 28.1% of the total.
- ransomhub was the most active group with 100 victims, up from 91 in October 2024.
- Business Services was the most-targeted sector with 164 victims (26.1% of the month's total), ahead of Manufacturing (88).
- Organizations in the United States accounted for 304 victims (48.3%), followed by Canada (30) and the United Kingdom (25); 9 victims did not disclose a location.
- One group, chort, appeared in HackerFeeds data for the first time this month.
Daily activity
Busiest day: Nov 18 (71 victims). Quietest day: Nov 10 (5 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | October 2024 | Change |
|---|---|---|---|---|---|
| 1 | ransomhub | 100 | 15.9% | 91 | +9 |
| 2 | akira | 44 | 7.0% | 19 | +25 |
| 3 | killsec | 33 | 5.2% | 33 | 0 |
| 4 | blacklock | 32 | 5.1% | 0 | +32 |
| 5 | incransom | 26 | 4.1% | 7 | +19 |
| 6 | ElDorado | 26 | 4.1% | 12 | +14 |
| 7 | lynx | 25 | 4.0% | 22 | +3 |
| 8 | qilin | 24 | 3.8% | 26 | −2 |
| 9 | hunters | 24 | 3.8% | 26 | −2 |
| 10 | fog | 20 | 3.2% | 24 | −4 |
| 11 | medusa | 18 | 2.9% | 17 | +1 |
| 12 | play | 16 | 2.5% | 49 | −33 |
| 13 | safepay | 15 | 2.4% | 15 | 0 |
| 14 | meow | 14 | 2.2% | 25 | −11 |
| 15 | blacksuit | 14 | 2.2% | 21 | −7 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Business Services | 164 | 26.1% |
| 2 | Manufacturing | 88 | 14.0% |
| 3 | Healthcare | 69 | 11.0% |
| 4 | Technology | 66 | 10.5% |
| 5 | Transportation/Logistics | 36 | 5.7% |
| 6 | Education | 36 | 5.7% |
| 7 | Financial Services | 34 | 5.4% |
| 8 | Agriculture and Food Production | 30 | 4.8% |
| 9 | Public Sector | 24 | 3.8% |
| 10 | Energy | 17 | 2.7% |
| 11 | Consumer Services | 15 | 2.4% |
| 12 | Hospitality and Tourism | 10 | 1.6% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 304 | 48.3% |
| 2 | Canada | 30 | 4.8% |
| 3 | United Kingdom | 25 | 4.0% |
| 4 | Germany | 20 | 3.2% |
| 5 | Australia | 20 | 3.2% |
| 6 | India | 19 | 3.0% |
| 7 | Italy | 17 | 2.7% |
| 8 | Brazil | 15 | 2.4% |
| 9 | United Arab Emirates | 15 | 2.4% |
| 10 | France | 12 | 1.9% |
| 11 | Spain | 8 | 1.3% |
| 12 | Switzerland | 7 | 1.1% |
| 13 | Netherlands | 6 | 1.0% |
| 14 | Mexico | 6 | 1.0% |
| 15 | Israel | 6 | 1.0% |
9 victims (1.4%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| chort | Nov 17, 2024 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Agencia Tributaria AEAT | trinity | ES | Nov 30, 2024 |
| shintex.by | dragonransomware | BY | Nov 30, 2024 |
| Mobigator Technology Group | dragonforce | HK | Nov 30, 2024 |
| EP:Schuller | sarcoma | AT | Nov 30, 2024 |
| www.sansirostadium.com | apt73 | IT | Nov 30, 2024 |
| Chema Per | sarcoma | PE | Nov 30, 2024 |
| candelasyasociados.es | lockbit3 | ES | Nov 30, 2024 |
| www.wsgcpa.com | ransomhub | US | Nov 30, 2024 |
| everde.com | ransomhub | US | Nov 30, 2024 |
| Mint Pharmaceuticals | 8base | CA | Nov 30, 2024 |
| Port of Rijeka | 8base | HR | Nov 30, 2024 |
| Originpath Group | 8base | ES | Nov 30, 2024 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 629 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.