All monthly reports
Ransomware attacks in February 2025
1,055 victims · 61 active groups · 7 new groups · 669 in January 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 1,055 ransomware victims claimed on leak sites in February 2025, up 57.7% from 669 in January 2025.
- 61 groups posted at least one victim; the three most active groups, clop (335), ransomhub (112) and akira (79), accounted for 49.9% of the total.
- clop was the most active group with 335 victims, up from 60 in January 2025.
- Technology was the most-targeted sector with 180 victims (17.1% of the month's total), ahead of Consumer Services (152).
- Organizations in the United States accounted for 547 victims (51.8%), followed by Canada (56) and Germany (43); 90 victims did not disclose a location.
- 7 groups appeared in HackerFeeds data for the first time this month, including insomnia, J and L Group.
Daily activity
Busiest day: Feb 27 (253 victims). Quietest day: Feb 16 (10 victims). Victims were posted on 28 of 28 days.
Most active groups
| # | Group | Victims | Share | January 2025 | Change |
|---|---|---|---|---|---|
| 1 | clop | 335 | 31.8% | 60 | +275 |
| 2 | ransomhub | 112 | 10.6% | 36 | +76 |
| 3 | akira | 79 | 7.5% | 71 | +8 |
| 4 | fog | 53 | 5.0% | 17 | +36 |
| 5 | qilin | 45 | 4.3% | 26 | +19 |
| 6 | play | 38 | 3.6% | 32 | +6 |
| 7 | lynx | 33 | 3.1% | 37 | −4 |
| 8 | medusa | 31 | 2.9% | 23 | +8 |
| 9 | thegentlemen | 28 | 2.7% | 0 | +28 |
| 10 | cactus | 25 | 2.4% | 19 | +6 |
| 11 | incransom | 21 | 2.0% | 29 | −8 |
| 12 | funksec | 21 | 2.0% | 35 | −14 |
| 13 | killsec | 20 | 1.9% | 9 | +11 |
| 14 | bianlian | 18 | 1.7% | 3 | +15 |
| 15 | safepay | 15 | 1.4% | 23 | −8 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Technology | 180 | 17.1% |
| 2 | Consumer Services | 152 | 14.4% |
| 3 | Manufacturing | 148 | 14.0% |
| 4 | Business Services | 111 | 10.5% |
| 5 | Transportation/Logistics | 77 | 7.3% |
| 6 | Healthcare | 62 | 5.9% |
| 7 | Education | 50 | 4.7% |
| 8 | Financial Services | 49 | 4.6% |
| 9 | Agriculture and Food Production | 40 | 3.8% |
| 10 | Construction | 39 | 3.7% |
| 11 | Public Sector | 29 | 2.7% |
| 12 | Energy | 20 | 1.9% |
Countries
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| mytower.com.br | funksec | BR | Feb 28, 2025 |
| stayzapp.in | funksec | IN | Feb 28, 2025 |
| mandarin.com.br | funksec | BR | Feb 28, 2025 |
| www.journeyoilfield.net | ransomhub | US | Feb 28, 2025 |
| www.casinoessentials.com | ransomhub | US | Feb 28, 2025 |
| California Gasket and Rubber Corporation | frag | US | Feb 28, 2025 |
| Bunting Capital Management Inc | frag | US | Feb 28, 2025 |
| Inversiones Clinica Del Meta SA | medusalocker | CO | Feb 28, 2025 |
| dsrny.com | ransomhub | US | Feb 28, 2025 |
| gettys.com | qilin | US | Feb 28, 2025 |
| bpmmicro.com | qilin | US | Feb 28, 2025 |
| Houston Symphony | qilin | US | Feb 28, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 1,055 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.