Ransomtracker · year archive
Ransomware attacks in 2024: 6,034 victims listed on leak sites
In 2024, ransomware operators listed 6,034 victims on their leak sites in 2024, across 102 operations and 108 countries where a location could be read from the listing. That is 11.3% more than 2023 (5,422). RansomHub was the most active operator with 632 listings (10.5% of the year), and November was the busiest month with 725. Every entry is an operator claim as published on a leak site, not a verified incident.
By month
Victims listed per month in 2024
Stacked by the five operators with the most listings in the year.
| Month | Listings | vs previous month | Most active operator |
|---|---|---|---|
| January 2024 | 307 | – | LockBit 3 62 |
| February 2024 | 433 | +126 | LockBit 3 125 |
| March 2024 | 416 | −17 | LockBit 3 55 |
| April 2024 | 422 | +6 | Play 32 |
| May 2024 | 620 | +198 | LockBit 3 185 |
| June 2024 | 438 | −182 | RansomHub 93 |
| July 2024 | 449 | +11 | RansomHub 49 |
| August 2024 | 525 | +76 | RansomHub 82 |
| September 2024 | 420 | −105 | RansomHub 76 |
| October 2024 | 611 | +191 | RansomHub 85 |
| November 2024 | 725 | +114 | RansomHub 100 |
| December 2024 | 668 | −57 | Funksec 108 |
Busiest single day: 9 May 2024 with 88 listings. Listings were recorded on 364 of the 366 days. Masked or placeholder victim names: 93.
Operators
Which ransomware groups were most active in 2024?
The 25 operators with the most leak-site listings in 2024. Names link to full operator profiles.
| # | Operator | Listings | Share | Last listing |
|---|---|---|---|---|
| 1 new | RansomHub | 632 | 10.5% | 31 Dec 2024 |
| 2 | LockBit 3 | 585 | 9.7% | 23 Dec 2024 |
| 3 | Play | 354 | 5.9% | 30 Dec 2024 |
| 4 | Akira | 313 | 5.2% | 27 Dec 2024 |
| 5 | Hunters International | 234 | 3.9% | 26 Dec 2024 |
| 6 | Medusa | 208 | 3.4% | 23 Dec 2024 |
| 7 | Qilin | 189 | 3.1% | 23 Dec 2024 |
| 8 | Black Basta | 185 | 3.1% | 18 Dec 2024 |
| 9 | Cactus | 178 | 2.9% | 23 Dec 2024 |
| 10 | BianLian | 169 | 2.8% | 26 Dec 2024 |
| 11 | INC Ransom | 165 | 2.7% | 28 Dec 2024 |
| 12 | Black Suit | 162 | 2.7% | 11 Dec 2024 |
| 13 | 8Base | 148 | 2.5% | 22 Dec 2024 |
| 14 | Meow | 130 | 2.2% | 19 Nov 2024 |
| 15 new | Funksec | 108 | 1.8% | 29 Dec 2024 |
| 16 new | El Dorado | 92 | 1.5% | 28 Dec 2024 |
| 17 | Ra Group | 92 | 1.5% | 28 Dec 2024 |
| 18 | DragonForce | 90 | 1.5% | 29 Dec 2024 |
| 19 new | Fog | 89 | 1.5% | 26 Dec 2024 |
| 20 new | Killsec3 | 87 | 1.4% | 21 Dec 2024 |
| 21 | Rhysida | 86 | 1.4% | 25 Dec 2024 |
| 22 new | Lynx | 86 | 1.4% | 24 Dec 2024 |
| 23 | Everest | 83 | 1.4% | 25 Dec 2024 |
| 24 new | Eraleign (APT73) | 72 | 1.2% | 24 Dec 2024 |
| 25 | Cloak | 70 | 1.2% | 30 Dec 2024 |
new marks an operator whose first listing in the Ransomtracker index falls in 2024. Rebrands (Conti to Black Basta, Royal to BlackSuit and so on) are counted under the name on the leak site at the time; lineage is annotated on the profiles.
Countries
Where were the victims listed in 2024?
Victim country where the operator’s own text, the victim’s domain or a recognisable city gave it away.
How much of the year could be placed
A country was identified for 24.1% of the 6,034 listings; 4,582 name no location and are not in the ranking. 108 countries appear at least once. Operators who write descriptions are over-represented, so read the ranking as a floor, not a census.
The live tracker carries the trailing-12-month map; verified incidents by country are on the confirmed attacks pages.
Context
How 2024 compares with other years
Leak-site listings per year in the Ransomtracker index. Earlier years are less complete: coverage of leak sites has widened every year, so part of the growth is measurement.
| Year | Victims listed | Change | Operators with listings |
|---|---|---|---|
| 2022 | 4,562 | – | 61 |
| 2023 | 5,422 | +18.9% | 71 |
| 2024 | 6,034 | +11.3% | 102 |
| 2025 | 8,835 | +46.4% | 140 |
| 2026 (to date) | 8,553 | year in progress | 168 |
FAQ
Frequently asked questions
How many ransomware attacks were there in 2024?
Ransomtracker recorded 6,034 victims listed on ransomware leak sites in 2024. These are operator claims as published, so they overstate confirmed incidents (some are duplicated, inflated or fabricated) and understate the real total (victims who pay quietly are never listed).
Which ransomware group was most active in 2024?
RansomHub, with 632 listings, 10.5% of all leak-site victims in 2024, ahead of LockBit 3 (585) and Play (354).
Which month had the most ransomware attacks in 2024?
November 2024, with 725 leak-site listings, 100 of them by RansomHub.
Which country had the most ransomware victims in 2024?
The United States, with 384 identified victims, 26.4% of the listings that could be placed in a country. A country could be read for 24.1% of listings, so the ranking is indicative.
Were there more ransomware attacks in 2024 than in 2023?
Yes: 6,034 listings in 2024 against 5,422 in 2023, a change of +11.3%.
Are these confirmed ransomware attacks?
No. Ransomtracker indexes what operators publish on their leak sites; nothing here is verified by Ransomnews. The separately maintained confirmed ransomware attacks dataset holds incidents corroborated against breach notifications, filings and press reports.
Data
Download and cite
Every listing behind this page is available as CSV (2024, one row per listing) and the figures above as JSON; a monthly summary CSV covers every year since 2022. Cite as Ransomnews Ransomtracker, with a link to this page. Figures recalculate from the live index; generated 15 October 2026 16:22 UTC.
Method: the collector parses each victim listing as operators publish it and records the organisation named, the operator, the listing time and the operator’s description. Country is a best-effort reading of that text and the victim’s domain. Source data: RansomLook (CC BY 4.0), aggregated, enriched and adapted by Ransomnews. The full methodology and caveats are on the tracker page.