BlackFog
Reports
All Statistics
The highest ransom demand in Q2 2026 was $25 million.
Qilin accounted for 285 undisclosed attacks (14%), The Gentlemen accounted for 219 (11%), and Dragon Force accounted for 137 (7%) in Q2 2026.
The number of undisclosed ransomware attacks fell 6% compared to the previous quarter.
Among publicly disclosed attacks, Qilin was responsible for 22 attacks (8%), ShinyHunters 16 attacks (6%), and INC 11 attacks (4%).
79 ransomware groups claimed victims during Q1 2026.
Among undisclosed ransomware attacks in Q1 2026, Qilin led with 339 attacks (16%), The Gentlemen 200 attacks (9%), and Akira 190 attacks (9%).
A $4 million ransom was demanded in a July 2025 DEVMAN attack on PT.EI. COM.
The number of unreported ransomware attacks in Q3 2025 showed a 21% increase compared with the same period in 2024.
80 groups published victims on dark web leak sites in Q3 2025.
A total of 276 publicly disclosed ransomware incidents occurred from April to June 2025.
April experienced a 51% increase in publicly disclosed ransomware attacks year-on-year, with a total of 89 attacks.
There was a 63% increase in publicly disclosed ransomware attack volumes in Q2 2025 compared to Q2 2024.
New ransomware variants accounted for nearly a third (32%) of all undisclosed attacks in 2024.
LockBit was the most active ransomware variant in 2024, affecting 603 victims. May was the busiest month with nearly 200 attacks.
When in came to ransomware, Retail saw a rise of 96% year-over-year.
The services industry recorded a 118% year-on-year increase in ransomware attack volume in 2025.
The healthcare sector accounted for 22% of all disclosed ransomware attacks in 2025.
Approximately 86% of ransomware attacks are never publicly reported.
Disclosed ransomware attacks targeting the services sector increased 221% compared to Q1 2026.
Publicly disclosed ransomware attacks totalled 306 in Q2 2026, a 16% increase compared to the previous quarter.
Victims were given an average of 7 days to meet ransom demands in Q2 2026.
Undisclosed ransomware attacks increased 40% year on year to 2,027 attacks in Q2 2026 from 1,446 in Q2 2025.
Among disclosed attacks, Shiny Hunters was responsible for 28 attacks (9%), Qilin for 19 attacks (6%), and INC for 13 attacks (4%) in Q2 2026.
30% of publicly disclosed ransomware incidents in Q2 2026 were not attributed to any known group.
Since first observed in June 2026, Settra claimed 22 victims, more than any other newly identified ransomware group in the quarter.
97% of disclosed ransomware incidents in Q2 2026 involved data exfiltration, the highest rate recorded.
Healthcare accounted for 81 disclosed ransomware attacks (26%) in Q2 2026, making it the most targeted sector.
28 new ransomware groups emerged in Q2 2026, twice as many as in Q1 2026.
93 ransomware groups were active in Q2 2026, including 28 newly formed groups.
57 ransomware variants were associated with disclosed attacks in Q2 2026, a 21% increase from Q1 2026.
The USA accounted for 169 disclosed ransomware attacks (55%) and Australia accounted for 54 disclosed attacks (18%) in Q2 2026.
The services sector experienced 45 disclosed attacks (15%) and government experienced 30 disclosed attacks (10%) in Q2 2026.
Settra launched attacks across seven countries within its first four days of activity.
The average volume of data stolen per undisclosed ransomware incident reached 508 GB in Q2 2026.
Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.
Healthcare accounted for 72 publicly disclosed ransomware attacks (27%) in Q1 2026.
There were 264 publicly disclosed ransomware attacks in Q1 2026, a 15% decrease year-on-year.
38% of publicly disclosed ransomware incidents were not attributed to any known group in Q1 2026.
The average ransom demand exceeded $1,028,214 in Q1 2026.
Only one in nine global ransomware attacks were publicly disclosed in Q1 2026.
The Gentlemen claimed 273 attacks since its emergence in 2025 through the end of Q1 2026.
Data exfiltration occured in 96% of ransomware attacks in Q1 2026.
The average volume of data stolen per undisclosed ransomware incident was 743 GB in Q1 2026.
Organizations across 39 countries were impacted by disclosed ransomware attacks in Q1 2026.
There were 2,160 undisclosed ransomware attacks identified in Q1 2026.
Victims were given an average of 7.7 days to meet ransom demands in Q1 2026.
Undisclosed ransomware attacks increased by 2% year-on-year.
Ransomware victims were located in 97 countries in Q1 2026.
Attacks on the logistics sector surged 200% year-on-year in Q1 2026.
Ransomware attacks in the healthcare sector accounted for 32% of all incidents in Q3 2025.