Ransomware attacks in January 2025
669 victims · 55 active groups · 3 new groups · 709 in December 2024 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 669 ransomware victims claimed on leak sites in January 2025, down 5.6% from 709 in December 2024.
- 55 groups posted at least one victim; the three most active groups, akira (71), babuk2 (64) and clop (60), accounted for 29.1% of the total.
- akira was the most active group with 71 victims, up from 65 in December 2024.
- Manufacturing was the most-targeted sector with 102 victims (15.2% of the month's total), ahead of Technology (97).
- Organizations in the United States accounted for 303 victims (45.3%), followed by Canada (35) and the United Kingdom (26); 28 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: morpheus, GDLockerSec and linkc.
Daily activity
Busiest day: Jan 24 (78 victims). Quietest day: Jan 2 (2 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | December 2024 | Change |
|---|---|---|---|---|---|
| 1 | akira | 71 | 10.6% | 65 | +6 |
| 2 | babuk2 | 64 | 9.6% | 0 | +64 |
| 3 | clop | 60 | 9.0% | 68 | −8 |
| 4 | lynx | 37 | 5.5% | 30 | +7 |
| 5 | ransomhub | 36 | 5.4% | 51 | −15 |
| 6 | funksec | 35 | 5.2% | 104 | −69 |
| 7 | play | 32 | 4.8% | 19 | +13 |
| 8 | incransom | 29 | 4.3% | 8 | +21 |
| 9 | qilin | 26 | 3.9% | 27 | −1 |
| 10 | 8base | 24 | 3.6% | 4 | +20 |
| 11 | safepay | 23 | 3.4% | 18 | +5 |
| 12 | medusa | 23 | 3.4% | 13 | +10 |
| 13 | cactus | 19 | 2.8% | 5 | +14 |
| 14 | fog | 17 | 2.5% | 22 | −5 |
| 15 | dragonforce | 16 | 2.4% | 8 | +8 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 102 | 15.2% |
| 2 | Technology | 97 | 14.5% |
| 3 | Business Services | 96 | 14.3% |
| 4 | Healthcare | 46 | 6.9% |
| 5 | Consumer Services | 46 | 6.9% |
| 6 | Financial Services | 40 | 6.0% |
| 7 | Agriculture and Food Production | 40 | 6.0% |
| 8 | Transportation/Logistics | 38 | 5.7% |
| 9 | Public Sector | 35 | 5.2% |
| 10 | Education | 27 | 4.0% |
| 11 | Energy | 20 | 3.0% |
| 12 | Construction | 17 | 2.5% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| morpheus | Jan 7, 2025 |
| GDLockerSec | Jan 24, 2025 |
| linkc | Jan 29, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Punjab.gov.pk | flocker | PK | Jan 31, 2025 |
| W*****e.com | flocker | — | Jan 31, 2025 |
| T*****p.com | flocker | — | Jan 31, 2025 |
| A**-****o.com | flocker | — | Jan 31, 2025 |
| Fayez Spa | medusa | CA | Jan 31, 2025 |
| Beauty Works Spa | medusa | CA | Jan 31, 2025 |
| Trimaco | medusa | US | Jan 31, 2025 |
| Farrar Corporation | dragonforce | US | Jan 31, 2025 |
| USGlobeCorp | dragonforce | US | Jan 31, 2025 |
| Kats, Jamison & Associates | dragonforce | US | Jan 31, 2025 |
| SCP Building Products | dragonforce | GB | Jan 31, 2025 |
| Engineering Design Initiative | dragonforce | US | Jan 31, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 669 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.