BlackFog
Reports
All Statistics
Qilin accounted for 285 undisclosed attacks (14%), The Gentlemen accounted for 219 (11%), and Dragon Force accounted for 137 (7%) in Q2 2026.
Among disclosed attacks, Shiny Hunters was responsible for 28 attacks (9%), Qilin for 19 attacks (6%), and INC for 13 attacks (4%) in Q2 2026.
57 ransomware variants were associated with disclosed attacks in Q2 2026, a 21% increase from Q1 2026.
79 ransomware groups claimed victims during Q1 2026.
Among publicly disclosed attacks, Qilin was responsible for 22 attacks (8%), ShinyHunters 16 attacks (6%), and INC 11 attacks (4%).
Among undisclosed ransomware attacks in Q1 2026, Qilin led with 339 attacks (16%), The Gentlemen 200 attacks (9%), and Akira 190 attacks (9%).
A $4 million ransom was demanded in a July 2025 DEVMAN attack on PT.EI. COM.
Reported ransomware attacks in August 2025 increased by 37%.
The healthcare, government, and technology industries together represented 53% of all publicly disclosed ransomware activity during Q3 2025.
95% of publicly disclosed ransomware attacks involved the theft of sensitive information.
A total of 276 publicly disclosed ransomware incidents occurred from April to June 2025.
May had a 40% increase in publicly disclosed ransomware attacks year-on-year, with a total of 91 attacks.
48 new ransomware groups emerged in 2024, a 65% increasefrom the previous year.
Medusa accounted for 5% of disclosed ransomware incidents in 2024.
Healthcare saw a 20% increase in ransomware attacks over the previous year.
The services industry recorded a 118% year-on-year increase in ransomware attack volume in 2025.
The healthcare sector accounted for 22% of all disclosed ransomware attacks in 2025.
The Play ransomware group accounted for 5% of disclosed ransomware attacks in 2025.
Healthcare accounted for 81 disclosed ransomware attacks (26%) in Q2 2026, making it the most targeted sector.
28 new ransomware groups emerged in Q2 2026, twice as many as in Q1 2026.
Settra launched attacks across seven countries within its first four days of activity.
The average volume of data stolen per undisclosed ransomware incident reached 508 GB in Q2 2026.
The number of undisclosed ransomware attacks fell 6% compared to the previous quarter.
Disclosed ransomware attacks targeting the services sector increased 221% compared to Q1 2026.
Victims were given an average of 7 days to meet ransom demands in Q2 2026.
The highest ransom demand in Q2 2026 was $25 million.
Publicly disclosed ransomware attacks totalled 306 in Q2 2026, a 16% increase compared to the previous quarter.
Undisclosed ransomware attacks increased 40% year on year to 2,027 attacks in Q2 2026 from 1,446 in Q2 2025.
30% of publicly disclosed ransomware incidents in Q2 2026 were not attributed to any known group.
Since first observed in June 2026, Settra claimed 22 victims, more than any other newly identified ransomware group in the quarter.
97% of disclosed ransomware incidents in Q2 2026 involved data exfiltration, the highest rate recorded.
93 ransomware groups were active in Q2 2026, including 28 newly formed groups.
The services sector experienced 45 disclosed attacks (15%) and government experienced 30 disclosed attacks (10%) in Q2 2026.
The USA accounted for 169 disclosed ransomware attacks (55%) and Australia accounted for 54 disclosed attacks (18%) in Q2 2026.
Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.
Healthcare accounted for 72 publicly disclosed ransomware attacks (27%) in Q1 2026.
There were 264 publicly disclosed ransomware attacks in Q1 2026, a 15% decrease year-on-year.
38% of publicly disclosed ransomware incidents were not attributed to any known group in Q1 2026.
The average ransom demand exceeded $1,028,214 in Q1 2026.
Only one in nine global ransomware attacks were publicly disclosed in Q1 2026.
The Gentlemen claimed 273 attacks since its emergence in 2025 through the end of Q1 2026.
Data exfiltration occured in 96% of ransomware attacks in Q1 2026.
Organizations across 39 countries were impacted by disclosed ransomware attacks in Q1 2026.
There were 2,160 undisclosed ransomware attacks identified in Q1 2026.
Victims were given an average of 7.7 days to meet ransom demands in Q1 2026.
Undisclosed ransomware attacks increased by 2% year-on-year.
Ransomware victims were located in 97 countries in Q1 2026.
The average volume of data stolen per undisclosed ransomware incident was 743 GB in Q1 2026.
Attacks on the logistics sector surged 200% year-on-year in Q1 2026.
In Q3 2025, 54 ransomware groups were linked to attacks.