Ransomware statistics and trends
Ransomware attacks hit a record high as The Gentlemen takes the top spot from Qilin
Our latest ransomware analysis tracked 2,894 attacks in Q3 2026, almost 50% more than a year ago, as personal rivalries at the top keep pushing activity up.
Last updated: October 2026
Trusted by industry leaders around the world
Why read our ransomware report?
We continuously monitor 200+ leak sites and the dark web, then turn our ransomware research into clear quarterly data, so you can see where ransomware is heading next. See the full methodology
KEY FINDINGS
What ransomware trends stood out this quarter?
Ransomware statistics for Q3 2026 show 2,894 incidents recorded between July and September, 8.6% more than in Q2 (2,664 incidents) and nearly 50% more than the 1,933 incidents counted in Q3 2025. This makes it the busiest quarter in over a year, with no signs of slowing down.
~50%
Attacks rose by almost 50% YoY, with 2,894 recorded in Q3 2026
20
Just 20 attacks stand between The Gentlemen and Qilin
2/3
2 in 3 businesses attacked had 200 employees or fewer
805
The US remains the top target, with 805 recorded attacks
A payout war is reshaping the ransomware market
A year ago, the ecosystem was still rebuilding after LockBit’s takedown and the shutdowns of BlackCat and RansomHub, which left affiliates without a home. Now, they’ve regrouped under new leaders, and because affiliates chase the best payout rather than the brand, even the top group can be unseated by the people that once powered it. The Gentlemen’s founder, a former top Qilin affiliate, split over an unpaid cut and lured his old colleagues away with a 90% payout – well above the usual 70% to 80%.
Skipping encryption is helping attackers move faster
More extortion groups are dropping encryption, choosing instead to steal data and threaten to leak it: “Stealing data is faster and simpler, so one group can hit many victims at once with far less effort,” says Mantas Sabeckis Senior Threat Intelligence Researcher at Nord Security. “This shift is likely a big part of why attack volumes keep climbing. But that doesn’t mean encryption is going away. Some groups still lock files and nothing else, others combine encryption with data extortion, and a growing number, like Cl0p, skip encryption entirely, betting that the threat of a leak is enough to force the target of the attack to pay the ransom.”
The Gentlemen take the top spot, but only just
Just 20 attacks separated The Gentlemen (383) and Qilin (363), and each group claimed more than 3 times as many victims as any group below them. Both break in through stolen credentials and exposed VPNs, and both hit many of the same industries. Where they split more clearly is the types of tooling they use to initiate their attacks. Qilin now uses AI to power personalized phishing campaigns at speed and scale, and auto-generate scripts that disable backups. Whereas The Gentlemen rely on in-house kits built to kill security software and give affiliates a ready-made way into their victims’ networks.
Healthcare attacks surge as attackers chase pressure
Healthcare made the biggest jump of any major sector in Q3 2026, up 30% to 150 attacks from 115 attacks in Q2, while IT rose about 10% to 210. Both sectors work under pressure that attackers exploit: hospitals can’t pause care, and a single IT provider breach can spread to many downstream customers.
See what the experts say
Ransomware specialists at Nord Security share their insights on the state of ransomware, from the latest findings to trends shaping what comes next.
The rivalry between The Gentlemen and Qilin plays out like a 1980s soap opera. Based on underground forum activity we observed, The Gentlemen's founder appears to have previously run one of Qilin's top affiliate crews before a dispute over an unpaid cut, which he took to an underground forum and lost. His answer was to start a new group and lure his former colleagues away with a 90% payout, well above the usual 70% to 80%. This quarter, the breakaway The Gentlemen group edged past Qilin by 20 attacks.
Senior Threat Intelligence Researcher at Nord Security
A year ago, the ransomware ecosystem was still rebuilding after LockBit’s takedown, and the shutdowns of BlackCat and RansomHub left affiliates without a home. Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era. The market has found its footing—going forward, it’s likely that even more new players will emerge, and attack numbers will continue to climb.
Cybersecurity Expert at NordLayer Intelligence by NordStellar
Stealing data is faster and simpler, so one group can hit many victims at once with far less effort. This shift is likely a big part of why attack volumes keep climbing. But that doesn’t mean encryption is going away. Some groups still lock files and nothing else, others combine encryption with data extortion, and a growing number, like Cl0p, skip encryption entirely, betting that the threat of a leak is enough to force the target of the attack to pay the ransom.
Senior Threat Intelligence Researcher at Nord Security
There’s no single ransomware model to defend against anymore. INC Ransom has stayed in the top five groups all year by concentrating its attacks, hitting a run of law firms in quick succession. Akira relies on speed instead, exploiting exposed VPN credentials and weak multi-factor authentication to encrypt data within hours, a method it has used against small firms for over a year. Each approach needs a different defense, which is a heavy load for small businesses that often don’t have a dedicated security team.
Cybersecurity Expert at NordLayer Intelligence by NordStellar
Attackers follow the money, so the strongest economies remain the biggest targets. North America accounted for almost half of all attacks we could locate, and Europe for more than a quarter, which means nearly three in four attacks hit those two regions alone.
Senior Threat Intelligence Researcher at Nord Security
The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t. Stolen logins protected by weak multi-factor authentication keep working, and known vulnerabilities in widely used enterprise products remain one of the most common entry points. What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk.
Cybersecurity Expert at NordLayer Intelligence by NordStellar
PRIORITY TARGETS
Where is ransomware hitting businesses the hardest?
Discover which businesses are most vulnerable with global ransomware statistics broken down by country and industry, as well as small business ransomware statistics broken down by company size.
By industry
Manufacturing stayed the top target, despite a slight 2% dip in attacks (347), accounting for 18.5% across all industries covered in our report. IT followed, rising about 10% to 210 attacks, accounting for 11.2%. Next came professional, scientific, and technical services (153 attacks), healthcare (150), and construction (133). Healthcare’s 30% surge was the sharpest move of any major sector.
By country
US businesses led by a wide margin with 805 attacks, about 10 times more than Germany, which overtook Canada for second place with 84. Canada fell 28% to 73, placing it ahead of the UK (69), Italy and France (61 each), and Spain (56). Meanwhile, India (55), Brazil (46), and Argentina (35) made their first appearance in the top 10, showing that profitable companies are in attackers’ sights wherever they operate.
By company size
Small and medium-sized businesses took the most hits again, with about 2 in 3 victims employing 200 people or fewer, and companies with 11 to 200 staff absorbing nearly half of all attacks. By revenue, the $5M to $50M bracket stayed the sweet spot, while attacks on billion-dollar enterprises fell from 40 to 25.
RANSOMWARE’S MOST WANTED
Which ransomware groups are most active right now?
Track the most notorious ransomware groups every quarter to see who is driving ransomware attack trends and how the “most wanted” list changes as takedowns and new actors reshape it.
The Gentlemen
Took the top spot with 383 attacks, up 35%.
Qilin
Slipped to second with 363 attacks, despite a 21% rise.
INC Ransom
Rose to third place with 110 attacks, holding a top-5 position all year.
Krybit
Took fifth position with 95 attacks, but the results could be inflated.
DISHONORABLE MENTIONS
Some of the best-known extortion groups don’t use ransomware
These groups often skip encryption altogether, steal data, and then threaten to leak it, which gets them the same leverage with far less effort, time, and resources required.
ShinyHunters
Linked to claims of roughly 1.5 billion records stolen from more than 1,000 customers of a major enterprise SaaS platform, ShinyHunters steals data and pressures victims directly for payment instead of encrypting anything.
World Leaks
Once the Hunters International ransomware brand, the group dropped encryption and relaunched in 2025 as a pure data theft operation, showing how blurred the line between ransomware and data extortion has become.
Scattered Spider
Specializing in social engineering, Scattered Spider has tricked its way into casinos and major retailers, often handing off the initial access behind some of the most damaging breaches without running a leak site of its own.
LAPSUS$
While never a ransomware brand, LAPSUS$ is a notoriety-driven crew that leaked stolen data rather than encrypting it, and the hands-on extortion playbook it pioneered is now used across the ecosystem.
HISTORICAL DATA
Track ransomware statistics by year and quarter
In the Q3 2026 report, we analyze the latest ransomware figures (2,894 incidents) against the numbers of other periods, which, according to our most recent data, stand at 1,933 incidents for Q3 2025 and 2,664 incidents for Q2 2026.
Review how ransomware trends have evolved over time. Each quarter shows a fixed snapshot of the figures as they were recorded at the time of each original quarterly publication. We collect data during the first weeks of each quarter, so the numbers here reflect what was captured at that time.
Volume settled into a new baseline as the rivalry between the two biggest groups heated up and attackers reached for bigger targets.
- Total number of incidents reached 2,581, nearly 4% from the previous quarter's total of 2,676.
- The US was the top target with 769 incidents, followed by Canada with 97, Germany with 83, the UK with 74, and France with 51.
- The manufacturing industry led with 336 incidents, followed by IT with 185.
- Ransomware group activities: Qilin was the top group with 299 incidents, The Gentlemen was second with 284, and DragonForce broke into third with 147.
- Businesses with fewer than 200 employees and less than $25 million in revenue were the most targeted, while attacks on $1B+ firms jumped 74%, from 23 to 40.
Q1 looked quiet at first, but late-reported victims kept landing for weeks, pushing the total well above the initial count.
- The first quarter of 2026, with only 2,283 incidents recorded—a 21.5% decrease from the record-breaking surge seen in late 2025.
- The US was the top target with 914 incidents, followed by Canada with 86, while the UK climbed into third place with 79 attacks, marking a 27% increase.
- The manufacturing industry led with 323 incidents, followed by IT with 152.
- Ransomware group activities: Qilin was the top group with 356 incidents. The Gentlemen was second with 207 incidents.
- SMBs – those with up to 200 employees and under $25 million in revenue – were the most targeted.
The year closed on a two-year high as attackers exploited end-of-year staffing gaps and rushed holiday operations.
- Q4 recorded 2,910 incidents, and a 38% increase compared to Q4 2024.
- The US was hit hardest with 917 incidents, Canada came in second with 107, followed by Germany with 64, the UK with 62, and France with 54.
- The manufacturing industry led with 386, followed by IT with 152 incidents.
- Ransomware group activities: Qilin dominated with 489 attacks.
- SMBs – those with up to 200 employees and under $25 million in revenue – were the most targeted.
Activity climbed steadily over the first 9 months as more groups joined and the RaaS model kept expanding.
- Between January and September 2025, 6,330 cases were exposed, which is a 47% increase compared to the same period last year.
- Of those, 1,943 recorded incidents in Q3 alone.
- The US accounted for 54% of all traced cases with 686 incidents, followed by Canada with 62 incidents, far behind in second place.
- The manufacturing industry was hit hardest, with 245 incidents, followed by IT with 103.
- Ransomware group activities: Qilin led with 241 incidents, followed by Akira with 190, and INC with 146.
- SMBs – those with up to 200 employees and under $25 million in revenue – were the most targeted.
The first half of the year brought a steep year-over-year rise, with attackers focused on the US and its manufacturing sector.
- In the first half of 2025, 4,198 cases were exposed on the dark web, marking a 49% surge compared to the same period in 2024. Of those cases, 1,758 were recorded in Q2 alone.
- The US was by far the most targeted country, accounting for 49% (596 incidents) of all attacks with a known location.
- The manufacturing sector was hit hardest, with 229 recorded cases.
- Ransomware group activities: Qilin was the most prolific, with 214 attacks; Safepay was a close second with 201.
- SMBs – those with up to 200 employees and under $25 million in revenue – were the most targeted.
FINAL THOUGHTS
“Ransomware is more competitive, active, and varied than it was a year ago, and the groups behind it are fighting to prove themselves. Whether they encrypt your systems or simply steal your data, they get in through the same familiar openings. Considering this, companies must avoid the it-won’t-happen-to-us mindset and get the basics right. This includes enforcing strong multi-factor authentication, patching known vulnerabilities quickly, watching for leaked credentials, and limiting how far an attacker can move once inside.”
Vakaris Noreika, Cybersecurity Expert at NordLayer Intelligence by NordStellar
PROTECT YOUR NETWORK
Build a ransomware-resistant business
These steps cut your exposure before an attack starts and limit the damage if one gets through, so a single incident never becomes a full shutdown.
- 1
Patch and update systems and apps on a fixed schedule.
- 2
Enforce multi-factor authentication and strong password policies.
- 3
Adopt a zero-trust framework to stop malware from spreading.
- 4
Back up data regularly and rehearse your incident response plan.
Additional info
Frequently asked questions
Ransomware is malware that locks or encrypts your files and holds them hostage until you pay a fee. Reviewing the latest ransomware statistics helps you understand how these attacks work and why they remain a constant threat to businesses.
Most attacks begin with phishing emails, stolen credentials, or unpatched software. Ransomware attack statistics consistently point to these routes, so closing them off does more to reduce your risk than almost any other single step.
RaaS lets affiliates rent ready-made ransomware from a core group in exchange for a share of the payout. Ransomware-as-a-service statistics show how this model turns extortion into a scalable business, and it sits behind many of the ransomware trends we track, as new gangs rise quickly.
Double extortion means attackers steal your data before encrypting it, then threaten to leak it unless you pay. It has become one of the defining ransomware facts of recent years, and our ransomware research shows that it is now a standard tactic.
Reliable, tested backups let you restore systems without paying, which removes the attacker’s main leverage. Ransomware statistics by year consistently show that backups remain a key defense against permanent data loss.
Dark web monitoring alerts you when your credentials or data surface on leak sites, often before an attack lands. Following the state of ransomware shows why that early warning matters, letting you reset access before a breach becomes an incident.