GuidePoint Security
Reports
All Statistics
The five most prolific ransomware groups collectively claimed more than 40% of all recorded attacks.
There were 91 active ransomware groups operating across 108 countries in Q2 2026, a record high.
Weekly victim postings never fell below 150 during Q2 2026.
The construction industry experienced 131 ransomware victims in Q1 2026, a 44% year-over-year increase.
The Gentlemen ransomware group increased from 35 victims in Q4 2025 to 182 victims in Q1 2026.
51% of observed ransomware victims in Q1 2026 were based in the United States; the United Kingdom and Canada each accounted for 4%.
Qilin's activity marks a 318% YoY increase.
In Q2 2025, there were 92 reports of ransomware attacks on healthcare organizations.
There were 1,576 total public posts related to ransomware victims (organizations and individuals) in Q3 2025.
5% of observed ransomware victims in Q2 2025 were based in Canada.
Qilin saw an 85% increase in activity, making it the most active threat group in Q2 2025.
There was a 23% decline in publicly reported ransomware incidents in Q2 2025, which may indicate changing attacker patterns beyond seasonal norms.
The first quarter of 2025 saw a record high in ransomware attacks, with 2,063 victims reported. This represents a 102% increase compared to the previous year.
There was also a record high number of active threat groups, with 70 identified in Q1 2025. This is a 55.5% year-over-year rise.
There was a 75% increase in actively exploited flaws compared to the same period in 2024, with 12,333 vulnerabilities reported in Q1 alone .
Manufacturing accounted for nearly 15% of reported ransomware victims in Q2 2026.
Q2 2026 recorded 2,279 reported ransomware victims, a 7% increase from Q1 2026 and a 43% increase from Q2 2025.
Ransomware victim post rates averaged approximately 150–200 per week in Q1 2026 and remained steady quarter-over-quarter and year-over-year.
Activity from the Qilin ransomware group declined by 25% and activity from the Akira ransomware group declined by 22%.
IncRansom's Q3 2025 victim count was 126 organizations and individuals.
There were 252 publicly claimed manufacturing organizations that were victims of ransomware attacks in Q3 2025.
SafePay impacted 71 organizations and individuals across 19 industries and 16 countries in Q3 2025.
In Q2 2025, ransomware attacks on healthcare organizations accounted for 5.8% of all ransomware attacks.
In Q3 2025, manufacturing organizations experienced a 26% increase in ransomware attacks.
Qilin recorded 234 victims (organizations and individuals) in Q3 2025.
56.00% of global ransomware victims (organizations and individuals) in Q3 2025 were from the United States.
The emerging threat group 'The Gentlemen' posted 32 victims (organizations and individuals) on a single day once their data leak site went live in 2025.
2.35% of global ransomware victims (organizations and individuals) in Q3 2025 were from France.
Qilin claimed 10 healthcare organizations as victims in Q3 2025.
GLOBAL and BlackLock had four distinct names in a little over a year.
IncRansom, SafePay, and Qilin together accounted for 30% of the 118 healthcare organizations that were victims in Q3 2025.
There were 77 total ransomware groups active in Q3 2025.
2.79% of global ransomware victims (organizations and individuals) in Q3 2025 were from Canada.
2.03% of global ransomware victims (organizations and individuals) in Q3 2025 were from Spain.
Ransomware groups claimed 118 healthcare organizations as victims in Q3 2025.
During Q3 2025, Akira claimed one healthcare industry organization as a victim on their DLS.
The average number of public posts related to ransomware victims (organizations and individuals) per week in Q3 2025 was 121.
2.48% of global ransomware victims (organizations and individuals) in Q3 2025 were from the Republic of Korea.
Rhysida has claimed over 200 organizations and individuals as victims to their dark web DLS.
Akira had 133 victims (organizations and individuals) in Q2 2025.
The 'The Gentlemen' group claimed 38 total victims (organizations and individuals) across the month of September 2025.
4.89% of global ransomware victims (organizations and individuals) in Q3 2025 were from Germany.
IncRansom had 62 victim claims (organizations and individuals) in Q2 2025.
GRIT observed 14 publicly disclosed ransomware attacks against state agencies, counties, and municipalities in Florida since July 2022.
The average number of ransomware groups posting victim data per week in Q3 2025 was 25.
Akira's victim count in Q3 is 212% higher than the same period in 2024.
10% to 15% of revenue was offered as a split for the core operator within the RaaS ecosystem.
IncRansom had 71 victim claims (organizations and individuals) in Q1 2025.
IncRansom claimed 14 healthcare organizations as victims in Q3 2025.
Akira experienced a single day spike of 20 claimed victims (organizations and individuals) on August 11th 2025.