All monthly reports
Ransomware attacks in May 2025
512 victims · 60 active groups · 3 new groups · 593 in April 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 512 ransomware victims claimed on leak sites in May 2025, down 13.7% from 593 in April 2025.
- 60 groups posted at least one victim; the three most active groups, qilin (68), safepay (54) and akira (48), accounted for 33.2% of the total.
- qilin was the most active group with 68 victims, up from 46 in April 2025.
- Manufacturing was the most-targeted sector with 70 victims (13.7% of the month's total), ahead of Technology (63).
- Organizations in the United States accounted for 233 victims (45.5%), followed by Canada (25) and Spain (22); 4 victims did not disclose a location.
- 3 groups appeared in HackerFeeds data for the first time this month: IMNCrew, Black X and global.
Daily activity
Busiest day: May 16 (28 victims). Quietest day: May 3 (5 victims). Victims were posted on 31 of 31 days.
Most active groups
| # | Group | Victims | Share | April 2025 | Change |
|---|---|---|---|---|---|
| 1 | qilin | 68 | 13.3% | 46 | +22 |
| 2 | safepay | 54 | 10.5% | 54 | 0 |
| 3 | akira | 48 | 9.4% | 74 | −26 |
| 4 | play | 39 | 7.6% | 36 | +3 |
| 5 | devman | 25 | 4.9% | 13 | +12 |
| 6 | worldleaks | 21 | 4.1% | 7 | +14 |
| 7 | incransom | 18 | 3.5% | 20 | −2 |
| 8 | nightspire | 17 | 3.3% | 22 | −5 |
| 9 | stormous | 15 | 2.9% | 1 | +14 |
| 10 | lynx | 14 | 2.7% | 22 | −8 |
| 11 | medusa | 11 | 2.1% | 14 | −3 |
| 12 | rhysida | 9 | 1.8% | 9 | 0 |
| 13 | payoutsking | 9 | 1.8% | 3 | +6 |
| 14 | interlock | 9 | 1.8% | 6 | +3 |
| 15 | everest | 9 | 1.8% | 1 | +8 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 70 | 13.7% |
| 2 | Technology | 63 | 12.3% |
| 3 | Business Services | 59 | 11.5% |
| 4 | Consumer Services | 43 | 8.4% |
| 5 | Healthcare | 42 | 8.2% |
| 6 | Construction | 36 | 7.0% |
| 7 | Financial Services | 35 | 6.8% |
| 8 | Public Sector | 26 | 5.1% |
| 9 | Transportation/Logistics | 24 | 4.7% |
| 10 | Education | 23 | 4.5% |
| 11 | Hospitality and Tourism | 21 | 4.1% |
| 12 | Agriculture and Food Production | 12 | 2.3% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 233 | 45.5% |
| 2 | Canada | 25 | 4.9% |
| 3 | Spain | 22 | 4.3% |
| 4 | Germany | 21 | 4.1% |
| 5 | Italy | 19 | 3.7% |
| 6 | United Kingdom | 14 | 2.7% |
| 7 | France | 13 | 2.5% |
| 8 | India | 12 | 2.3% |
| 9 | Brazil | 12 | 2.3% |
| 10 | Japan | 11 | 2.1% |
| 11 | South Africa | 7 | 1.4% |
| 12 | Singapore | 7 | 1.4% |
| 13 | Australia | 6 | 1.2% |
| 14 | United Arab Emirates | 6 | 1.2% |
| 15 | Venezuela | 5 | 1.0% |
4 victims (0.8%) did not disclose a location.
Groups seen for the first time
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| Volkswagen | stormous | DE | May 31, 2025 |
| lantro.com | devman | JP | May 31, 2025 |
| Chrisman Commercial | lynx | US | May 31, 2025 |
| Volkswagen Group | stormous | DE | May 31, 2025 |
| Astro Industries Inc. | qilin | US | May 31, 2025 |
| Alert Medical Alarms | qilin | US | May 31, 2025 |
| VANTAGE | qilin | CA | May 31, 2025 |
| Rochon | play | US | May 31, 2025 |
| alereon.com | incransom | US | May 31, 2025 |
| teamsignal.com | safepay | US | May 31, 2025 |
| hlb.ie | safepay | IE | May 31, 2025 |
| Huron Regional Medical Center | beast | US | May 31, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 512 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.