The State of Ransomware Q1 | 2026

Among publicly disclosed attacks, Qilin was responsible for 22 attacks (8%), ShinyHunters 16 attacks (6%), and INC 11 attacks (4%).

79 ransomware groups claimed victims during Q1 2026.

Among undisclosed ransomware attacks in Q1 2026, Qilin led with 339 attacks (16%), The Gentlemen 200 attacks (9%), and Akira 190 attacks (9%).

Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.

Healthcare accounted for 72 publicly disclosed ransomware attacks (27%) in Q1 2026.

There were 264 publicly disclosed ransomware attacks in Q1 2026, a 15% decrease year-on-year.

38% of publicly disclosed ransomware incidents were not attributed to any known group in Q1 2026.

The average ransom demand exceeded $1,028,214 in Q1 2026.

Only one in nine global ransomware attacks were publicly disclosed in Q1 2026.

The Gentlemen claimed 273 attacks since its emergence in 2025 through the end of Q1 2026.

Data exfiltration occured in 96% of ransomware attacks in Q1 2026.

The average volume of data stolen per undisclosed ransomware incident was 743 GB in Q1 2026.

Organizations across 39 countries were impacted by disclosed ransomware attacks in Q1 2026.

There were 2,160 undisclosed ransomware attacks identified in Q1 2026.

Victims were given an average of 7.7 days to meet ransom demands in Q1 2026.

Undisclosed ransomware attacks increased by 2% year-on-year.

Ransomware victims were located in 97 countries in Q1 2026.

Attacks on the logistics sector surged 200% year-on-year in Q1 2026.