Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
US #1 most targeted country

Ransomware attacks in United States

10,138 organisations in United States have been listed on ransomware leak sites, ranking #1 worldwide. Updated .

Victims
10,138
43% of global total
Global rank
#1
of 180 countries
Active groups
209
Most: Qilin
Sectors
21
Most: Business Services

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in United States. Figures are computed from the tracked records, not inferred.

United States sees 10122 ransomware attacks recorded globally, ranking first; most active groups Qilin, Akira, Play target sectors Business Services, Manufacturing, Healthcare.

United States in the global picture

United States accounts for 10,138 of the ransomware disclosures tracked here, ranking #1 worldwide and making up 43% of the global total. The sectors listed most often are Business Services, Manufacturing, Healthcare.

Who is most active in United States

Qilin — 1,024 victims in United States. Qilin ransomware was first observed in July of 2022. Akira — 890 victims in United States. The Akira ransomware group is said to have emerged in March 2023, and there's much speculation about its ties to the former CONTI ransomware group. Play — 785 victims in United States. Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America.

Where to report an incident in United States

National computer emergency response teams for United States, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: United States

United States ranks #1 worldwide for ransomware disclosures, with 10,138 victims in this database — 43% of the global total. The groups listing the most organisations here are Qilin, Akira and Play.

The most frequently listed industries in United States are Business Services, Manufacturing, Healthcare. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

As one of the largest economies with extensive digital infrastructure, United States offers ransomware operators a large pool of high-value organisations across many industries. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in United States 10,138

Page 1 of 102
Organization Disclosed
Linebarger Goggan Blair & Sampson
Everest
Performance Ford Inc
N0n
SGLA (Schwartz, Giannini, Lantsberger & Adamson)
Spacebears
Adobe Insurance Brokers, LLC
Pear
Bruin Group LLC
Emperador
Cascade Flooring America
Akira
Coastal Alabama Community College
Interlock
genesys.com
Scarlettgroup
Heritage Senior Living
N0n
Hypertherm
Helix
LEGAL-RECORDS.US
Clop
nbcuniversal.com
Scarlettgroup
olyortho.com
Braincipher
Porter Hedges LLP
Silentransomgroup
prosomnus.com
Braincipher
sodali.com
Braincipher
srsnodgrass.com
Braincipher
TheHomeMag NorCal
N0n
Westrock Coffee
Helix
Xylanpicks
N0n
51Ridge (Newark NJ hosting/IT)
N0n
Asensus Surgical
Dark project
Beach Eye Medical Group
Dark project
centralrogers.com
Incransom
Chicago Vein Institute
Booba project
City Hall - Everett, MA
Booba project
City of Mt. Angel, Oregon
Booba project
COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA
Booba project
Duarte Nursery, Inc.
Aurora
Graves Fireplaces, Inc.
Global secret group
Pearland Pediatrics
Booba project
Research Foundation of The City University of New York
Booba project
The Excalibur Group
Dark project
American Campus
Helix
Baker Donelson
Redact
Baltimore Tank Lines
Storm
chooseultimate.com
Lockbit5
Company #93
N0n
Company #94
N0n
Dental Team FL
Qilin
Finzly Corp
N0n
Froggys Fog
N0n
Hotel DuPont
N0n
Kingwood Endoscopy
N0n
Latham & Watkins
Silentransomgroup
Merit Financial Group
Storm
Patriot Maritime
Storm
POWERsonic Industries Inc.
Aurora
Rosenberg & Pittinsky
Global secret group
Seminole Schools
Global secret group
The Akeeli Group
N0n
Vormittag Associates Inc
N0n
Walbro
Nitrogen
acclaimcompanies.com
Settra
Amagi Media Labs
N0n
Company #89
N0n
Company #90
N0n
Company #91
N0n
ECO USA
N0n
exo.inc
Settra
Llano Independent School District
Qilin
mckenneys
Iah6477
monroeroadways.com
Settra
Quikrete
Helix
SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo...
N0n
Southwire
Helix
www.marvinpac.com
Settra
Bay Alarm
Helix
Company #84
N0n
Company #85
N0n
Company #86
N0n
Company #88
N0n
First Dental Health
Thegentlemen
oakgrovetech
Dragonforce
Personify Health
Helix
polisee Inc
Vexy ransomware
Rheem Global
Helix
Smith Douglas Homes
Helix
Adams Warehouse & Delivery, Inc.
Aurora
Axle Logistics
Thegentlemen
BladeTech Inc
N0n
Campbell Rhea
Thegentlemen
Caretaker Landscape and Tree Management
Pear
Company #71
N0n
Company #74
N0n
Company #75
N0n
Company #76
N0n
Company #77
N0n
Company #79
N0n
Company #82
N0n
Cradlewise Inc.
The seven deadly sins
CureMetrix, Inc.
The seven deadly sins
Entry Systems Garage Doors Gates
Thegentlemen
Girl Scouts of Eastern Massachusetts
Wallstreet
Globeia Inc.
The seven deadly sins
Harness Inc.
The seven deadly sins
iHeartJane
The seven deadly sins
Macfarlan Capital Partners
Pear
Newport Beach Dentistry
Thegentlemen
North Bridge Venture Partners
Thegentlemen
1–100 of 10,138

Frequently asked questions

How many ransomware attacks have occurred in United States?

United States has recorded 10,138 ransomware victim disclosures in this database, ranking #1 globally. This represents 43% of all tracked ransomware attacks worldwide.

Which ransomware groups target United States?

The ransomware groups most active in United States are Qilin, Akira, Play, Incransom. These groups collectively account for the majority of victim disclosures attributed to United States.

Which industries are most targeted by ransomware in United States?

In United States, the most frequently targeted sectors are Business Services, Manufacturing, Healthcare. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does United States rank globally for ransomware attacks?

United States ranks #1 globally for ransomware attacks with 10,138 victim disclosures, representing 43% of the worldwide total of 23,585 tracked victims.

How can organisations in United States protect against ransomware?

Organisations in United States should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting United States is also recommended.