The number of ransomware victims listed on data leak sites increased by 27% year-on-year in April, reaching a total of 354 victims, with the manufacturing sector being the most affected industry, according to GuidePoint Security’s monthly GRIT Ransomware Report. However, the actual number of victims is likely much higher, as many choose to pay the ransom and are not featured on such leak sites.
Why it matters: Manufacturers accounted for 19% of the victims on the analyzed sites, or one fifth of all victims. This indicates that they are likely often targeted due to their low tolerance for production disruptions.
- Victim volumes decreased by 22% between March and April of this year, but manufacturers experienced a significant increase of 46%.
- LockBit was the most prominent ransomware group, comprising 31% of the victims listed on leak sites in April, followed by Alphv at 14%. However, the ransomware landscape is increasingly characterized by a large number of smaller groups.
- Ransomware groups are employing more aggressive tactics to coerce victims into paying, such as launching distributed denial-of-service (DDoS) attacks, leaking sensitive internal chats, and even hijacking university alert systems to pressure administrators.
