Ransomtracker · year archive
Ransomware attacks in 2023: 5,422 victims listed on leak sites
In 2023, ransomware operators listed 5,422 victims on their leak sites in 2023, across 71 operations and 104 countries where a location could be read from the listing. That is 18.9% more than 2022 (4,562). LockBit 3 was the most active operator with 1,054 listings (19.4% of the year), and August was the busiest month with 704. Every entry is an operator claim as published on a leak site, not a verified incident.
By month
Victims listed per month in 2023
Stacked by the five operators with the most listings in the year.
| Month | Listings | vs previous month | Most active operator |
|---|---|---|---|
| January 2023 | 159 | – | LockBit 3 50 |
| February 2023 | 265 | +106 | LockBit 3 128 |
| March 2023 | 454 | +189 | Cl0p 105 |
| April 2023 | 408 | −46 | LockBit 3 114 |
| May 2023 | 445 | +37 | LockBit 3 77 |
| June 2023 | 477 | +32 | Cl0p 98 |
| July 2023 | 565 | +88 | Cl0p 171 |
| August 2023 | 704 | +139 | Clop Torrents 237 |
| September 2023 | 549 | −155 | LockBit 3 85 |
| October 2023 | 441 | −108 | LockBit 3 66 |
| November 2023 | 515 | +74 | LockBit 3 112 |
| December 2023 | 440 | −75 | LockBit 3 86 |
Busiest single day: 23 May 2023 with 91 listings. Listings were recorded on 365 of the 365 days. Masked or placeholder victim names: 130.
Operators
Which ransomware groups were most active in 2023?
The 25 operators with the most leak-site listings in 2023. Names link to full operator profiles.
| # | Operator | Listings | Share | Last listing |
|---|---|---|---|---|
| 1 | LockBit 3 | 1,054 | 19.4% | 30 Dec 2023 |
| 2 | ALPHV/BlackCat | 454 | 8.4% | 30 Dec 2023 |
| 3 | Cl0p | 399 | 7.4% | 17 Dec 2023 |
| 4 | Play | 305 | 5.6% | 31 Dec 2023 |
| 5 new | 8Base | 280 | 5.2% | 25 Dec 2023 |
| 6 | BianLian | 246 | 4.5% | 28 Dec 2023 |
| 7 new | Clop Torrents | 238 | 4.4% | 20 Oct 2023 |
| 8 | Dispossessor | 187 | 3.4% | 30 Dec 2023 |
| 9 new | Akira | 179 | 3.3% | 25 Dec 2023 |
| 10 new | Noescape | 157 | 2.9% | 4 Dec 2023 |
| 11 | Black Basta | 147 | 2.7% | 28 Dec 2023 |
| 12 new | Medusa | 143 | 2.6% | 17 Dec 2023 |
| 13 | Royal | 123 | 2.3% | 19 Jul 2023 |
| 14 new | Cactus | 99 | 1.8% | 29 Dec 2023 |
| 15 new | Rhysida | 78 | 1.4% | 26 Dec 2023 |
| 16 new | Ransomed | 78 | 1.4% | 30 Oct 2023 |
| 17 | Stormous | 73 | 1.3% | 25 Dec 2023 |
| 18 new | Ra Group | 69 | 1.3% | 20 Dec 2023 |
| 19 | Snatch | 62 | 1.1% | 17 Dec 2023 |
| 20 new | Losttrust | 53 | 1.0% | 26 Sep 2023 |
| 21 new | INC Ransom | 46 | 0.8% | 30 Dec 2023 |
| 22 | Qilin | 46 | 0.8% | 27 Dec 2023 |
| 23 | Monti | 45 | 0.8% | 8 Dec 2023 |
| 24 | Ransomhouse | 42 | 0.8% | 29 Dec 2023 |
| 25 new | Ransomware Blog | 41 | 0.8% | 5 Dec 2023 |
new marks an operator whose first listing in the Ransomtracker index falls in 2023. Rebrands (Conti to Black Basta, Royal to BlackSuit and so on) are counted under the name on the leak site at the time; lineage is annotated on the profiles.
Countries
Where were the victims listed in 2023?
Victim country where the operator’s own text, the victim’s domain or a recognisable city gave it away.
How much of the year could be placed
A country was identified for 33.3% of the 5,422 listings; 3,615 name no location and are not in the ranking. 104 countries appear at least once. Operators who write descriptions are over-represented, so read the ranking as a floor, not a census.
The live tracker carries the trailing-12-month map; verified incidents by country are on the confirmed attacks pages.
Context
How 2023 compares with other years
Leak-site listings per year in the Ransomtracker index. Earlier years are less complete: coverage of leak sites has widened every year, so part of the growth is measurement.
| Year | Victims listed | Change | Operators with listings |
|---|---|---|---|
| 2022 | 4,562 | – | 61 |
| 2023 | 5,422 | +18.9% | 71 |
| 2024 | 6,034 | +11.3% | 102 |
| 2025 | 8,835 | +46.4% | 140 |
| 2026 (to date) | 8,553 | year in progress | 168 |
FAQ
Frequently asked questions
How many ransomware attacks were there in 2023?
Ransomtracker recorded 5,422 victims listed on ransomware leak sites in 2023. These are operator claims as published, so they overstate confirmed incidents (some are duplicated, inflated or fabricated) and understate the real total (victims who pay quietly are never listed).
Which ransomware group was most active in 2023?
LockBit 3, with 1,054 listings, 19.4% of all leak-site victims in 2023, ahead of ALPHV/BlackCat (454) and Cl0p (399).
Which month had the most ransomware attacks in 2023?
August 2023, with 704 leak-site listings, 237 of them by Clop Torrents.
Which country had the most ransomware victims in 2023?
The United States, with 589 identified victims, 32.6% of the listings that could be placed in a country. A country could be read for 33.3% of listings, so the ranking is indicative.
Were there more ransomware attacks in 2023 than in 2022?
Yes: 5,422 listings in 2023 against 4,562 in 2022, a change of +18.9%.
Are these confirmed ransomware attacks?
No. Ransomtracker indexes what operators publish on their leak sites; nothing here is verified by Ransomnews. The separately maintained confirmed ransomware attacks dataset holds incidents corroborated against breach notifications, filings and press reports.
Data
Download and cite
Every listing behind this page is available as CSV (2023, one row per listing) and the figures above as JSON; a monthly summary CSV covers every year since 2022. Cite as Ransomnews Ransomtracker, with a link to this page. Figures recalculate from the live index; generated 15 October 2026 16:24 UTC.
Method: the collector parses each victim listing as operators publish it and records the organisation named, the operator, the listing time and the operator’s description. Country is a best-effort reading of that text and the victim’s domain. Source data: RansomLook (CC BY 4.0), aggregated, enriched and adapted by Ransomnews. The full methodology and caveats are on the tracker page.