Key Findings
The five largest ransomware actors controlled 43.6% of all victims.
7,551 publicly disclosed ransomware victims were identified between April 1, 2025 and March 31, 2026, a 24.9% increase from the previous reporting period.
There were 146 active ransomware groups by June 2026, including 61 new groups entering during the reporting period.
Stealer log exposure increased 175% in a before-and-after security posture comparison.
30.8% of ransomware victims carried KEV exposure.
18.5% of ransomware victims carried FocusTag signals.
Ransomware activity accelerated 60% in the second half of the reporting period and closed with 861 victims in March 2026, the highest monthly total in four years.
Qilin claimed more than 1,300 victims, nearly twice as many as its nearest rival.
43.5% of victims still carried critical patch vulnerabilities in the latest assessment.