RESEARCH
Ransomware Victims Hit a Record 5,243 in 2024 — 46 New Groups Fueled a 15% Surge in Dark-Web Leak Site Postings
Ransomware attack victim postings on criminal leak sites reached 5,243 in 2024, a 15% year-over-year increase from 4,548 in 2023. Forty-six new ransomware groups entered the market during the year, accounting for nearly half of all active groups. Despite rising victim counts, total ransom payments globally dropped 35% to $813 million — indicating more organizations are refusing to pay. Sources converge on the scale of the problem but diverge in methodology and focus, producing an indeterminate consensus signal.
Findings
- 5,243 ransomware victims were posted on dark web leak sites in 2024 — a 15% increase from 4,548 in 2023 — with Q4 2024 alone recording 1,663 victims, the highest single quarter ever measured.
- 46 new ransomware groups emerged in 2024, representing 48% of all active groups that year; the average new group survived just 3.9 months before disbanding or rebranding under a new identity.
- RansomHub became the most active group with 531 published victims, while the top 10 groups collectively accounted for 52.8% of all attacks — showing simultaneous market consolidation and fragmentation.
- Total global ransomware payments declined 35% to $813 million in 2024 even as victim counts rose, indicating that more organizations are refusing to pay — a trend that reduces attacker revenue but does not reduce data exposure risk.
Delta Engine result
↔ Divergence Detected — Δ 0.359 (threshold 0.05)
- Corvus Insurance / Travelers T0 92
- Cyberint T0 88
- Rapid7 T0 84
- Emsisoft T0 72
- IBM Security T0 64
Evidence quality
avg 25 · min 25 · max 25 · spread 0