Ransomware attacks in March 2025
736 victims · 66 active groups · 9 new groups · 1,055 in February 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 736 ransomware victims claimed on leak sites in March 2025, down 30.2% from 1,055 in February 2025.
- 66 groups posted at least one victim; the three most active groups, babuk2 (87), ransomhub (72) and akira (65), accounted for 30.4% of the total.
- babuk2 was the most active group with 87 victims, after posting none in February 2025.
- Technology was the most-targeted sector with 115 victims (15.6% of the month's total), ahead of Manufacturing (115).
- Organizations in the United States accounted for 308 victims (41.8%), followed by Germany (42) and Canada (37); 27 victims did not disclose a location.
- 9 groups appeared in HackerFeeds data for the first time this month, including crazyhunter, skira and VanHelsing.
Daily activity
Busiest day: Mar 31 (44 victims). Quietest day: Mar 9 (7 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | February 2025 | Change |
|---|---|---|---|---|---|
| 1 | babuk2 | 87 | 11.8% | 0 | +87 |
| 2 | ransomhub | 72 | 9.8% | 112 | −40 |
| 3 | akira | 65 | 8.8% | 79 | −14 |
| 4 | qilin | 44 | 6.0% | 45 | −1 |
| 5 | safepay | 42 | 5.7% | 15 | +27 |
| 6 | play | 34 | 4.6% | 38 | −4 |
| 7 | fog | 30 | 4.1% | 53 | −23 |
| 8 | lynx | 27 | 3.7% | 33 | −6 |
| 9 | incransom | 23 | 3.1% | 21 | +2 |
| 10 | SilentRansomGroup | 20 | 2.7% | 1 | +19 |
| 11 | nightspire | 19 | 2.6% | 1 | +18 |
| 12 | dragonforce | 18 | 2.4% | 5 | +13 |
| 13 | medusa | 17 | 2.3% | 31 | −14 |
| 14 | killsec | 17 | 2.3% | 20 | −3 |
| 15 | arcusmedia | 13 | 1.8% | 5 | +8 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Technology | 115 | 15.6% |
| 2 | Manufacturing | 115 | 15.6% |
| 3 | Business Services | 86 | 11.7% |
| 4 | Healthcare | 64 | 8.7% |
| 5 | Public Sector | 56 | 7.6% |
| 6 | Consumer Services | 47 | 6.4% |
| 7 | Financial Services | 39 | 5.3% |
| 8 | Construction | 38 | 5.2% |
| 9 | Education | 36 | 4.9% |
| 10 | Transportation/Logistics | 30 | 4.1% |
| 11 | Agriculture and Food Production | 20 | 2.7% |
| 12 | Hospitality and Tourism | 17 | 2.3% |
Countries
Groups seen for the first time
| Group | First victim |
|---|---|
| crazyhunter | Mar 5, 2025 |
| skira | Mar 6, 2025 |
| VanHelsing | Mar 12, 2025 |
| secp0 | Mar 14, 2025 |
| nova | Mar 22, 2025 |
| ralord | Mar 22, 2025 |
| arkana | Mar 24, 2025 |
| sinobi | Mar 24, 2025 |
| silent | Mar 27, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| attorneykohm.com | VanHelsing | US | Mar 31, 2025 |
| alertenterprise.com | VanHelsing | US | Mar 31, 2025 |
| stattorney.org | kairos | US | Mar 31, 2025 |
| Pak Technologies | chaos | PK | Mar 31, 2025 |
| Evans Distribution Systems | chaos | US | Mar 31, 2025 |
| Transcore | chaos | US | Mar 31, 2025 |
| TransCore ITS, LLC | crypto24 | AE | Mar 31, 2025 |
| PLN | dragonforce | ID | Mar 31, 2025 |
| pln.co.id - PLN INDONESIA | babuk2 | ID | Mar 31, 2025 |
| moh.gov.rw | babuk2 | RW | Mar 31, 2025 |
| jackpotjunction.com | lockbit3 | US | Mar 31, 2025 |
| jackpotjunction.com | ransomhub | US | Mar 31, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 736 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.