BlackFog tracked 376 publicly disclosed ransomware attacks in 2022, a 29% jump from 2021 and a 34% rise from 2020. The data reveals a decisive shift in attacker behavior: data exfiltration now accompanies 89% of all incidents, up from 80% the prior year. Perhaps most striking for security planners, education displaced government as the most targeted sector—a change that reflects strategic victim selection rather than random targeting.
The 2022 ransomware statistics tell a clear story about where attackers see opportunity and how they are adapting their methods to maximize pressure on victims. For organizations evaluating their defensive posture, the trends demand a reassessment of assumptions about who is at risk and what a successful attack actually looks like.
At a Glance
- 376 publicly disclosed ransomware attacks in 2022, up 29% from 2021
- 89% of attacks involved data exfiltration, a 9-point increase year-over-year
- Education sector targeted in 17% of attacks, overtaking government at 16%
- Education and health both saw 49% increases in attack volume compared to 2021
- LockBit accounted for 16% of successful attacks, growing 600% from 2021
- PowerShell use reached 87% of all attacks; dark web shaming sites appeared in 23%
Geographic Concentration and Attacker Origins
The United States remained the dominant target, representing 46% of all attacks—an 18% increase over 2021. The UK and Canada followed at 7% and 6% respectively. Two out of every three attacks worldwide hit just three countries, a concentration that has held steady since 2021.
From the attacker side, China and Russia accounted for 27% and 17% of observed data exfiltration activity respectively, together representing 44% of global targeting. China's share grew 11 points; Russia's grew 5 points. These figures reflect both the scale of state-linked threat activity and the degree to which geopolitical tensions are playing out through financially motivated crimeware groups.
LockBit led the ransomware statistics by volume, responsible for 16% of successful attacks. The group's 600% surge from negligible 2021 activity made it the defining threat of 2022. BlackCat and Hive followed, each climbing from obscurity to second and third place by year-end. Conti, despite high-profile incidents earlier in the year, finished at 9%.
Why the Sector Shift Matters
The rise of education as the primary target reflects cold economics. Schools, universities, and research institutions typically operate on tight budgets with limited security staffing. They hold valuable personal data on students, faculty, and research subjects—and they often lack the incident response capacity to detect or contain an intrusion before data leaves the network.
The 49% increase in both education and healthcare targeting drove this shift. Government and technology sectors saw smaller but still significant increases of 17% and 14%. For security teams in any underfunded sector, these ransomware statistics should read as a direct warning: attackers are actively prioritizing your organization type.
Say you manage IT for a mid-sized school district. You likely run aging systems, have limited staff, and hold sensitive records on minors and staff members. The BlackFog data suggests your district faces attack probability well above the baseline. The question is not whether an attacker will eventually probe your perimeter but whether you will have patched critical vulnerabilities and configured network segmentation before they succeed.
Tactical Evolution: PowerShell, Dark Web, and Pressure
PowerShell appeared in 87% of all attacks, up 7 points from 2021. This reflects the widespread adoption of living-off-the-land techniques that blend with legitimate administrative activity. Detecting malicious PowerShell execution requires behavioral analysis rather than signature matching—an important consideration for teams still relying on traditional antivirus.
The dark web shaming tactic grew even more dramatically, appearing in 23% of attacks versus just 5% in 2021. Attackers now routinely publish stolen data when victims refuse to pay, applying reputational and legal pressure that pure encryption alone does not achieve. This shift undermines the common assumption that offline backups render ransomware toothless. Backups address downtime; they do not address data publication.
What to Watch Next
The 2022 ransomware statistics point to several trends that will likely accelerate. Data exfiltration is now the default, not the exception. Organizations that still plan their incident response around recovery from encryption alone are leaving the most dangerous attack vector unaddressed. Expect more groups to adopt double-extortion and triple-extortion tactics, especially against sectors holding highly sensitive personal or financial data.
LockBit's dominance raises the stakes for tracking its affiliates and infrastructure. When one group commands 16% of all successful attacks, defensive resources spent understanding their tooling and distribution methods deliver outsized returns.
Key takeaways
- Ransomware attacks reached 376 in 2022, with 89% involving data exfiltration rather than encryption alone
- Education became the most targeted sector, with both education and healthcare seeing 49% annual increases
- LockBit dominated the threat landscape with 600% growth and 16% market share
- PowerShell and dark web shaming tactics signal a shift toward stealthy execution and maximum victim pressure
- Organizations must assume data will be targeted regardless of their ability to recover from encryption
Frequently asked questions
How many ransomware attacks occurred in 2022 according to BlackFog's report?
BlackFog recorded 376 publicly disclosed ransomware attacks in 2022, representing a 29% increase over 2021 and a 34% increase over 2020.
Which sectors were most targeted by ransomware in 2022?
Education was the most targeted sector at 17% of all attacks, followed by government at 16% and health services at 15%. Both education and healthcare saw 49% increases in targeting compared to 2021.
What percentage of ransomware attacks involved data exfiltration?
Data exfiltration occurred in 89% of 2022 attacks, up from 80% in 2021, indicating that most ransomware incidents now include theft of sensitive data alongside encryption.
Which ransomware group was most active in 2022?
LockBit was the most active group, responsible for 16% of successful attacks, up dramatically from minimal activity in 2021—a 600% increase in a single year.
How can organizations defend against the shift to data exfiltration tactics?
Organizations should assume that perimeter defenses may be breached and focus on detecting unusual data movement, implementing network segmentation, and developing incident response plans that address data publication scenarios alongside recovery from encryption.
Inspired by reporting from: blackfog.com