RESEARCH

Ransomware Victims Hit a Record 5,243 in 2024 — 46 New Groups Fueled a 15% Surge in Dark-Web Leak Site Postings

Ransomware attack victim postings on criminal leak sites reached 5,243 in 2024, a 15% year-over-year increase from 4,548 in 2023. Forty-six new ransomware groups entered the market during the year, accounting for nearly half of all active groups. Despite rising victim counts, total ransom payments globally dropped 35% to $813 million — indicating more organizations are refusing to pay. Sources converge on the scale of the problem but diverge in methodology and focus, producing an indeterminate consensus signal.

Findings

  • 5,243 ransomware victims were posted on dark web leak sites in 2024 — a 15% increase from 4,548 in 2023 — with Q4 2024 alone recording 1,663 victims, the highest single quarter ever measured.
  • 46 new ransomware groups emerged in 2024, representing 48% of all active groups that year; the average new group survived just 3.9 months before disbanding or rebranding under a new identity.
  • RansomHub became the most active group with 531 published victims, while the top 10 groups collectively accounted for 52.8% of all attacks — showing simultaneous market consolidation and fragmentation.
  • Total global ransomware payments declined 35% to $813 million in 2024 even as victim counts rose, indicating that more organizations are refusing to pay — a trend that reduces attacker revenue but does not reduce data exposure risk.

Delta Engine result

↔ Divergence Detected — Δ 0.359 (threshold 0.05)

Evidence quality

avg 25 · min 25 · max 25 · spread 0