Publicly disclosed U.S. ransomware attacks in 2023

Ransomware attacks continue to plague the U.S., and it's often difficult to gauge just how bad the problem is.

The lack of transparency and consistent reporting for ransomware attacks has hampered visibility into the threat, making it challenging to determine how many organizations have been victimized.

Since the beginning of 2022, TechTarget Editorial's security news team has researched and tracked public disclosures and reports of attacks against organizations in the U.S. each month in a ransomware database. The database compiles data breach notification letters from various state and federal government agencies as well as publicly confirmed reports of ransomware attacks.

The ransomware targets have ranged from municipal government services, public school systems, private universities, small businesses and large enterprises across the country. Last year, nearly 300 attacks against U.S. organizations were recorded in TechTarget Editorial's 2022 ransomware database, though the number of actual attacks was almost certainly higher.

Breach notification letters submitted to various state and federal agencies are often vague and provide little detail about the nature of the security incident in question. In addition, organizations sometimes avoid disclosing or confirming whether such incidents involved ransomware, even when the attacks contain tell-tale signs.

As such there are typically several breach notifications letters each month that describe security incidents indicative of a ransomware attack. But they do not explicitly state that one took place.

TechTarget Editorial's ransomware database includes notifications that either explicitly state that ransomware was involved or includes language that indicates systems and data were encrypted by malicious actors. In the absence of direct confirmations from victim organizations, TechTarget Editorial assesses corroborating information, such as third-party reports and claims from ransomware gangs to determine if a ransomware attack likely took place.

The database does not include attacks claimed by ransomware gangs without corroborating evidence, such as leaked data or a corresponding disclosure of a cyber attack from the purported victim organization. It also omits attacks by extortion groups that do not deploy actual ransomware and only steal and exfiltrate sensitive data.

While malware-less extortion attacks are becoming more common, this database lists attacks by known ransomware gangs. Some incidents may not involve malware deployment because threat activity was detected or blocked before the payload could be delivered.

Below are the ransomware attacks TechTarget Editorial has tracked for each month in 2023. The entries include the following data for each incident:

• The name of the organization that was attacked
• When the attack was first publicly disclosed, either through a notification letter or confirmed report
• When the attack occurred
• The victim's location/headquarters

In addition, TechTarget Editorial provides a recap of each month's ransomware activity in separate articles that examine some of the more notable attacks and emerging trends.

• January
• February