Ransomware examples fall into two groups: famous attacks that made the news, and the criminal groups that run most attacks today. WannaCry (2017), NotPetya (2017), Colonial Pipeline (2021), Cl0p’s MOVEit campaign (2023) and Change Healthcare (2024) show what an attack can do. LockBit, Akira, Qilin, RansomHub and Cl0p are groups named in recent government advisories. This page explains both, and the main types of ransomware.
What are the best-known examples of ransomware attacks?
These five were widely reported and are documented by public authorities. Each links to our incident or group page with the full source list.
- 12 May 2017WannaCry hits the NHS in EnglandComputers locked in hospital trusts and GP practices.
- 27 June 2017NotPetya begins in UkraineLooked like ransomware, but files could not be recovered.
- 7 May 2021Colonial Pipeline shuts its pipeline systemDarkSide attacked the IT network; the FBI confirmed the group.
- 27 May 2023Cl0p starts exploiting MOVEit TransferData theft from many organizations at once.
- February 2024Change Healthcare is hitStolen credentials on a portal without multi-factor authentication.
The WannaCry attack on the NHS was released worldwide on 12 May 2017. The National Audit Office found that five accident and emergency departments had to divert patients, 595 GP practices were infected, and that every infected organization had unpatched or unsupported Windows systems. It called the attack relatively unsophisticated and preventable with basic IT security practice.
The NotPetya outbreak began on 27 June 2017. CISA described it spreading with PsExec, WMI and the EternalBlue and EternalRomance exploits. Because the encryption key was not tied to the victim, CISA said decryption might be impossible even after payment, so it behaved more like a wiper than true ransomware.
The Colonial Pipeline attack in May 2021 used DarkSide, a ransomware as a service. CISA and the FBI said they saw no sign that the operational technology network was directly affected; the attack hit the IT side, and the company still halted its pipeline system.
In the Change Healthcare attack of February 2024, the company’s CEO told a US House committee that criminals used stolen credentials on a remote access portal that had no multi-factor authentication, took data, and deployed ransomware nine days later.
The Cl0p group shows a different pattern. Its 2023 campaign against the MOVEit Transfer file transfer tool (CVE-2023-34362) focused on stealing data from underlying databases rather than encrypting systems, according to a joint FBI and CISA advisory.
What are the main types of ransomware?
The word covers several kinds of attack. Europol’s No More Ransom project, which offers free decryption tools, lists encryption ransomware, lock screen ransomware, boot record (MBR) ransomware, web server ransomware and mobile ransomware. In business attacks, two models matter most: how the data is held, and how the criminals organize their work.
| Type | What it means | What the victim faces |
|---|---|---|
| Crypto (encryption) ransomware | Encrypts files and folders so they cannot be opened | Needs a key or a clean restore from backups |
| Locker ransomware | Locks the screen or device and demands payment | Access is blocked, files may be intact |
| Double extortion | Data is both encrypted and stolen, with a threat to leak it | Restoring backups does not end the pressure |
| Ransomware as a service (RaaS) | The core team rents its malware to partner criminals, called affiliates | Many different attackers, one toolkit |
CISA defines ransomware as malware designed to encrypt files on a device, making them and the systems that rely on them unusable. Its guide describes double extortion as encrypting files while also stealing data and threatening to release it. Some actors skip the encryption and rely on data theft alone.
The ransomware as a service model is why attacks are so widespread. LockBit, for example, recruited affiliates to attack with its tools and infrastructure, according to a joint advisory (AA23-165A).
Which ransomware groups are most active today?
No public source gives one official ranking. The most reliable view comes from joint advisories by the FBI, CISA and partner agencies, plus Europol’s yearly assessment. Europol observed more than 120 active ransomware brands in 2025, and said many operations are short-lived and rebrand quickly. The groups below have each been named in a government advisory or a MITRE ATT&CK entry. Our post on the top ransomware groups of Q2 2026 follows who is posting victims.
- LockBit: described by CISA as the most deployed ransomware variant in the world in 2022.
- Akira: seen since March 2023; claimed about 244.17 million US dollars in proceeds as of late September 2025, per advisory AA24-109A.
- RansomHub: a ransomware as a service that encrypted and stole data from at least 210 victims between February and August 2024, per advisory AA24-242A.
- Qilin: a ransomware as a service active since at least 2022, with versions for Windows, Linux and VMware ESXi, per MITRE ATT&CK.
- Cl0p: known for mass data theft through file transfer software.
- 120+Active ransomware brands Europol observed in 2025Source: Europol IOCTA 2026; CISA advisories AA24-109A and AA24-242A
- 244.17M USDAkira proceeds claimed as of late September 2025Source: Europol IOCTA 2026; CISA advisories AA24-109A and AA24-242A
- 210+RansomHub victims, February to August 2024Source: Europol IOCTA 2026; CISA advisories AA24-109A and AA24-242A
What do these ransomware examples have in common?
The entry points repeat. CISA lists internet-facing vulnerabilities, compromised credentials, phishing, precursor malware and third-party or managed service provider compromises as common ways in. WannaCry used unpatched systems. Change Healthcare lacked multi-factor authentication on a portal. Akira targets VPN services without it.
Three habits would have limited most of them: patch internet-facing systems quickly, require multi-factor authentication on remote access, and keep offline, tested backups. CISA and the UK NCSC both advise offline backups, and both advise against paying a ransom because payment does not guarantee you get your data back. For what to do after an attack, read our guide to ransomware recovery and detection.
Early warning matters too. Stolen credentials and victim listings often appear before the encryption starts. Ransomware Intelligence and our ransomware early warning use case cover that, and the page on ransomware leak site listings explains how to respond when your name appears.
Sources
The UK National Audit Office investigated WannaCry and the NHS (report page). CISA published the NotPetya alert (alert) and the DarkSide advisory used for Colonial Pipeline (AA21-131A). The Change Healthcare account is from written testimony to a US House committee (testimony, 1 May 2024). Group facts come from advisories AA23-165A, AA24-109A, AA24-242A and AA23-158A, and from MITRE ATT&CK on Qilin. General guidance: the CISA #StopRansomware Guide, the NCSC ransomware page, the No More Ransom Q&A and the Europol IOCTA 2026 report.
Last checked against sources: 10 October 2026.