In 2023, at least 36 Belgian companies fell victim to ransomware attacks, with industry and services being the most affected.

In 2023, at least 36 Belgian companies were targeted by ransomware attacks. This is what researchers from Unit 42 at Palo Alto Networks write in a report. The findings are based on research into so-called leak sites on the Dark Web, where victims are published in order to pressure them into paying ransoms. Since not all ransomware groups use such websites, the actual number of Belgian victims is likely higher.

The research team found a significant increase in the number of posts on ransomware leak sites worldwide, with an increase of nearly 50 percent compared to the previous year. Criminal activity peaked particularly in July and November. The researchers note that new zero-day vulnerabilities came to light during this period. Additionally, 25 new leak sites linked to organizations offering ransomware-as-a-service emerged in 2023. Even in the underworld, starting a new business is a challenge: not all newcomers survive their first year.

LockBit 3.0 dominates in Belgium

In Belgium in particular, the LockBit 3.0 group was most active. LockBit was responsible for 16 of the 36 documented victims. Industry and services were the worst hit sectors, with six and seven victims respectively.

Unit 42’s report also shows that encouraging progress is being made in police neutralization of ransomware groups. Several gangs were put down. So Hive and Ragnar Locker got the lid on their noses. LockBit was targeted by law enforcement earlier this year, but unfortunately was able to quickly recover.