An apparatus having counters for sub-addresses in segments of row address to count activation commands applied to row addresses including the sub-addresses. The counters are configured to count activation commands applied to row addresses containing the sub-addresses in accessing rows of memory cells in a memory device; For example, in response to an activation command applied to a row address having first sub-addresses, counts stored in a portion of the counters corresponding to the first sub-addresses are increased for the count of the activation command. For each respective segment, counts stored in counters for sub-addresses in the respective segment are used to determine whether at least one of the sub-addresses has seen more activation commands than a threshold. An alert is generated for risk mitigation operations in response to each segment having at least one sub-address that has seen more activation commands than the threshold.