Greetings, Cybersecurity Enthusiasts!
December closed out the year with sustained breach volume and heavy ransomware pressure from a handful of dominant crews. Activity remained concentrated in North America and Europe, while professional services and manufacturing continued to absorb disproportionate impact. Here is what defined the month.
📊 Cyber Incidents Breakdown
Across all monitored sources, we recorded 1,678 breaches in December. Ransomware remained a leading driver of high-impact events alongside continued defacement volume and steady public reporting.
Source Mix
Ransomware Posts: 810
Defacements: 409
News Coverage: 206
Official Reports: 79
SEC Filings: 2
Hacker Forums: 168
Leak Reports: 4
💥 Most Active Ransomware Gangs
The most prolific ransomware groups in December were:
Qilin — 170 victims
LockBit — 90 victims
Akira — 76 victims
SafePay — 68 victims
Sinobi — 54 victims
Qilin led by a wide margin, while LockBit, Akira, and SafePay maintained strong operational tempo and broad targeting reach across industries and geographies.
🆕 Enhanced Ransomware Gang Tracking
HackNotice has expanded tracking and intelligence coverage for the following groups, reflecting their high activity:
• osiris
• root
• ms13-089
• minteye
• trident
📰 Breaches That Made the News
Several high-profile breaches captured global attention in December:
• Korean Air: https://app.hacknotice.com/#/hack/6951ddf5de7caace1956bef8
• Asiana Airlines: https://app.hacknotice.com/#/hack/694d7579de7caace19b70de5
• Trust Wallet: https://app.hacknotice.com/#/hack/694eb31fde7caace19cce786
• SoundCloud: https://app.hacknotice.com/#/hack/6940aa61de7caace198b46fa
• Neighbourly: https://app.hacknotice.com/#/hack/6957c62dde7caace198e366d
• Unleash Protocol: https://app.hacknotice.com/#/hack/69554d36de7caace197dd06f
• Oltenia Energy Complex: https://app.hacknotice.com/#/hack/695292c5de7caace1942780e
🏭 Industry and Geography Insights
Industries Most Impacted
• Professional, Scientific, and Technical Services: 15.8%
• Manufacturing: 15.7%
• Construction: 9.0%
• Information: 7.3%
• Health Care and Social Assistance: 6.5%
Industry Trends
• Professional services and manufacturing remained high-leverage targets due to credential exposure, remote access pathways, and operational disruption potential.
• Construction and healthcare sustained steady pressure, with attackers continuing to pursue disruption and data exposure outcomes.
• Information-sector targeting stayed elevated, consistent with access-leak and data-theft driven operations.
🌍 Regions Most Affected
• North America: 54.7%
• Europe: 22.3%
• Asia: 8.5%
• South America: 6.7%
• Middle East: 5.1%
• Oceania: 1.5%
• Africa: 1.2%
Regional Trends
• North America remained the primary concentration of ransomware impact, with Europe holding steady as the second-largest hotspot.
• Asia and South America continued meaningful exposure as multiple gangs widened targeting scope.
• The Middle East saw sustained activity driven by a smaller number of aggressive crews.
✅ Closing Thoughts
December reinforced the continued intensity of ransomware-driven risk. High-volume operations from the top gangs, combined with persistent cross-industry exposure, underline why breach intelligence must be continuous, real-time, and ecosystem-aware.
🔍 If you are not tracking ransomware’s role in third-party exposure, you are missing a critical blind spot.
Stay ahead of shifting threats with HackNotice’s real-time intelligence across ransomware, breaches, and dark-web activity.
👉 Request a demo to see how HackNotice helps you manage adversary intelligence for third-party risk.
