Comparitech

80% (12 out of 15) of The Gentlemen’s attack claims were against higher education institutions.

Of 104 ransomware attacks on educational institutions in H1 2026, 36 were confirmed by the targeted entities.

There were 104 ransomware attacks in total against educational institutions in H1 2026.

In H1 2026, one government entity confirmed it paid a ransom while 16 government entities said they did not pay.

The median ransom demand in H1 2026 was $100,000, which is one-fifth of the H2 2025 median of $500,000.

The United States accounted for 31% of government ransomware attacks in H1 2026, with 58 of the 187 attacks, representing a 23% decline from 75 attacks in H2 2025.

Of 479 ransomware attacks logged in April 2025, 39 attacks were confirmed by the targeted entity through means such as a data breach notification or press release.

Breakdown of Confirmed Attacks (39 total) by Sector in April 2025: Businesses: 21 confirmed attacks, Government Entities: 9 confirmed attacks, Healthcare Companies: 6 confirmed attacks, Educational Institutions: 3 confirmed attacks.

Most Prolific Ransomware Gangs (based on attack claims) in April 2025: Qilin: 67 claims. This is an increase from 45 claims in March, Akira: 62 claims, Play: 50 claims, Lynx: 32 claims, NightSpire: 22 claims. RansomHub listed no new victims in April.

The UK recorded 13 ransomware attacks on the education sector, a 225% increase from 4 attacks in H2 2025.

The US recorded the most confirmed ransomware attacks on the education sectorm with 12 confirmed in H1 2026.

Brazil, Poland, and Japan each had three confirmed ransomware attacks on the education sector in H1 2026.

Six of The Gentlemen’s 15 claimed ransomware attacks on the education sector were confirmed.

The Gentlemen claimed the most confirmed attacks (6) on the education sector, followed by Interlock (4) and Qilin and LockBit (3 each).

Ransomware attacks on higher education increased more than 8% from H2 2025 to H1 2026.

The Gentlemen’s attacks on education increased 275% from H2 2025 to H1 2026.

There were 68 unconfirmed ransomware attacks against educational institutions in H1 2026.

Nearly 693,000 records are known to have been breached in the confirmed education-sector ransomware attacks in H1 2026.

The median ransom demand in the education sector is $420,620, a 53% increase from $275,000 in H2 2025.

No ransom payments were confirmed in H1 2026 in the education sector, and five entities confirmed they had not met their hackers’ demands.

Qilin claimed 15 attacks on the education sector in H1 2026, a 38% decrease from 24 claims in H2 2025, with three of Qilin’s attacks confirmed.

Attacks via LockBit on the education sector increased 29% and attacks via Nova increased 50% in H1 2026 compared to H2 2025.

34 of 104 attacks (33%) in H1 2026 targeted educational institutions in the US, a 44% decline from 61 attacks in H2 2025.

Attacks on K-12 decreased 26% from H2 2025 to H1 2026.

Interlock had six claims in H1 2026 versus seven claims in H2 2025, with four of Interlock’s attacks confirmed on the education sector.

The Gentlemen and Qilin each claimed 15 attacks on the education sector; LockBit claims 9 attacks; Interlock and Nova each claim 6 attacks.

Brazil recorded 8 ransomware attacks (a 33% increase) and Thailand recorded 5 attacks (a 150% increase) on the education sector in H1 2026.

Attacks on the education sector dropped by 13% from 120 attacks in H2 2025 to 104 attacks in H1 2026.

From H2 2025 to H1 2026, France’s government-targeted attacks declined by 20%, Germany’s increased by 13%, and South Africa’s increased by 50%.

The ransomware group The Gentlemen claimed 22 attacks on government agencies in H1 2026, up from a single claimed attack in H2 2025.

The Gentlemen made 504 attack claims in total across sectors in 2026 so far.

Ten entities targeted by The Gentlemen in 2026 had confirmed attacks.

Ransomware attacks on government entities increased by over 13%, rising from 165 to 187 attacks between H2 2025 and H1 2026.

H1 2026 had 187 ransomware attacks on government entities in total, with 89 confirmed attacks and 98 unconfirmed attacks.

Confirmed ransomware attacks on government entities involved 179,000 known breached records in H1 2026.

The strains with the most confirmed attacks on government entities were The Gentlemen (10), Qilin (9), LockBit (7), and INC (6).

The City of Suffolk, Virginia breach affected 157,725 people in February 2026.

İzelman A.Ş. (İzmir municipal parking service) reports that 10,000 people may have been impacted in its March 2026 breach.

The City of Middletown, Ohio began notifying 123,791 people of a breach originating in July 2025.

Lørenskog kommune in Norway faced a $1.18 million ransom demand.

Secretaria de Estado de Saúde de Mato Grosso in Brazil faced a $500,000 ransom demand and said the hackers’ claim of 200 TB stolen was likely exaggerated.

Germany recorded 9 attacks, France recorded 8 attacks, and South Africa recorded 6 attacks on government entities in H1 2026.

Of US government-targeted attacks in H1 2026, 33 were confirmed; Germany had 7 confirmed attacks; Italy and Spain each had 4 confirmed attacks.

LockBit’s attacks on government agencies increased by 250%, rising from 4 in H2 2025 to 14 in H1 2026, with seven of those attacks confirmed.

From H2 2025 to H1 2026, ransomware attacks in the US declined across all sectors by 8%.

German municipal transport company Verkehrsgesellschaft Main-Tauber took 11 weeks to recover from its January 2026 ransomware attack.

From January to June 2026, an average of one ransomware attack on a government entity occured every day.

The most prolific ransomware strains by number of claims against government organizations were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10).

Murray County in the US paid $200,000 in May 2026 to prevent data from being released.

Winona County notified 6,196 people of a breach following its January 2026 attack.