Ransomtracker · year archive
Ransomware attacks in 2022: 4,562 victims listed on leak sites
In 2022, ransomware operators listed 4,562 victims on their leak sites in 2022, across 61 operations and 80 countries where a location could be read from the listing. LockBit 3 was the most active operator with 1,922 listings (42.1% of the year), and August was the busiest month with 727. Every entry is an operator claim as published on a leak site, not a verified incident.
By month
Victims listed per month in 2022
Stacked by the five operators with the most listings in the year.
| Month | Listings | vs previous month | Most active operator |
|---|---|---|---|
| January 2022 | 689 | – | LockBit 3 398 |
| February 2022 | 425 | −264 | LockBit 3 245 |
| March 2022 | 403 | −22 | LockBit 3 241 |
| April 2022 | 467 | +64 | LockBit 3 246 |
| May 2022 | 388 | −79 | LockBit 3 209 |
| June 2022 | 223 | −165 | LockBit 3 132 |
| July 2022 | 204 | −19 | LockBit 3 66 |
| August 2022 | 727 | +523 | LockBit 3 127 |
| September 2022 | 258 | −469 | LockBit 3 113 |
| October 2022 | 245 | −13 | LockBit 3 57 |
| November 2022 | 240 | −5 | Royal 48 |
| December 2022 | 293 | +53 | LockBit 3 55 |
Busiest single day: 18 August 2022 with 593 listings. Listings were recorded on 336 of the 365 days. Masked or placeholder victim names: 62.
Operators
Which ransomware groups were most active in 2022?
The 25 operators with the most leak-site listings in 2022. Names link to full operator profiles.
| # | Operator | Listings | Share | Last listing |
|---|---|---|---|---|
| 1 | LockBit 3 | 1,922 | 42.1% | 31 Dec 2022 |
| 2 | Cl0p | 577 | 12.6% | 4 Nov 2022 |
| 3 | ALPHV/BlackCat | 244 | 5.3% | 29 Dec 2022 |
| 4 | Hive | 197 | 4.3% | 30 Dec 2022 |
| 5 | Black Basta | 150 | 3.3% | 15 Dec 2022 |
| 6 | Vicesociety | 138 | 3.0% | 20 Dec 2022 |
| 7 | Conti | 123 | 2.7% | 7 Jun 2022 |
| 8 | Avoslocker | 93 | 2.0% | 4 Oct 2022 |
| 9 | Royal | 77 | 1.7% | 31 Dec 2022 |
| 10 | Everest | 77 | 1.7% | 23 Nov 2022 |
| 11 | Karakurt | 76 | 1.7% | 16 Dec 2022 |
| 12 | BianLian | 74 | 1.6% | 29 Dec 2022 |
| 13 | Cuba | 73 | 1.6% | 2 Dec 2022 |
| 14 | Quantum | 63 | 1.4% | 9 Dec 2022 |
| 15 | Lorenz | 55 | 1.2% | 7 Dec 2022 |
| 16 | Icefire | 55 | 1.2% | 27 Aug 2022 |
| 17 | Dispossessor | 54 | 1.2% | 25 Dec 2022 |
| 18 | Ragnarlocker | 42 | 0.9% | 28 Dec 2022 |
| 19 | Snatch | 42 | 0.9% | 28 Dec 2022 |
| 20 | Play | 39 | 0.9% | 27 Dec 2022 |
| 21 | Cooming | 38 | 0.8% | 4 Feb 2022 |
| 22 | Blackbyte | 37 | 0.8% | 29 Dec 2022 |
| 23 | Lv | 35 | 0.8% | 15 Nov 2022 |
| 24 | Ransomhouse | 21 | 0.5% | 24 Dec 2022 |
| 25 | RansomEXX | 20 | 0.4% | 11 Dec 2022 |
Rebrands (Conti to Black Basta, Royal to BlackSuit and so on) are counted under the name on the leak site at the time; lineage is annotated on the profiles.
Countries
Where were the victims listed in 2022?
Victim country where the operator’s own text, the victim’s domain or a recognisable city gave it away.
How much of the year could be placed
A country was identified for 23.9% of the 4,562 listings; 3,470 name no location and are not in the ranking. 80 countries appear at least once. Operators who write descriptions are over-represented, so read the ranking as a floor, not a census.
The live tracker carries the trailing-12-month map; verified incidents by country are on the confirmed attacks pages.
Context
How 2022 compares with other years
Leak-site listings per year in the Ransomtracker index. Earlier years are less complete: coverage of leak sites has widened every year, so part of the growth is measurement.
| Year | Victims listed | Change | Operators with listings |
|---|---|---|---|
| 2022 | 4,562 | – | 61 |
| 2023 | 5,422 | +18.9% | 71 |
| 2024 | 6,034 | +11.3% | 102 |
| 2025 | 8,835 | +46.4% | 140 |
| 2026 (to date) | 8,553 | year in progress | 168 |
FAQ
Frequently asked questions
How many ransomware attacks were there in 2022?
Ransomtracker recorded 4,562 victims listed on ransomware leak sites in 2022. These are operator claims as published, so they overstate confirmed incidents (some are duplicated, inflated or fabricated) and understate the real total (victims who pay quietly are never listed).
Which ransomware group was most active in 2022?
LockBit 3, with 1,922 listings, 42.1% of all leak-site victims in 2022, ahead of Cl0p (577) and ALPHV/BlackCat (244).
Which month had the most ransomware attacks in 2022?
August 2022, with 727 leak-site listings, 127 of them by LockBit 3.
Which country had the most ransomware victims in 2022?
The United States, with 191 identified victims, 17.5% of the listings that could be placed in a country. A country could be read for 23.9% of listings, so the ranking is indicative.
Are these confirmed ransomware attacks?
No. Ransomtracker indexes what operators publish on their leak sites; nothing here is verified by Ransomnews. The separately maintained confirmed ransomware attacks dataset holds incidents corroborated against breach notifications, filings and press reports.
Data
Download and cite
Every listing behind this page is available as CSV (2022, one row per listing) and the figures above as JSON; a monthly summary CSV covers every year since 2022. Cite as Ransomnews Ransomtracker, with a link to this page. Figures recalculate from the live index; generated 15 October 2026 16:29 UTC.
Method: the collector parses each victim listing as operators publish it and records the organisation named, the operator, the listing time and the operator’s description. Country is a best-effort reading of that text and the victim’s domain. Source data: RansomLook (CC BY 4.0), aggregated, enriched and adapted by Ransomnews. The full methodology and caveats are on the tracker page.