Report by Comparitech
Ransomware roundup: Q3 2026 stats on attacks, ransoms, and active gangs
Key Findings
Of the 247 confirmed Q3 2026 ransomware attacks, 138 were on businesses.
Of the 247 confirmed Q3 2026 attacks, 36 were on healthcare companies.
Of the 2,380 unconfirmed Q3 2026 ransomware attacks, 71 were on government entities.
Of the 2,380 unconfirmed Q3 2026 attacks, 55 were on educational institutions.
There were 124 government sector attacks in Q3 2026 in total, with 53 confirmed and 71 unconfirmed.
Q3 2026 saw 188 ransomware attacks on the healthcare sector in total, a 39% increase from Q2 2026 (135).
The education sector recorded 75 ransomware attacks in Q3 2026 in total, a 50% increase from Q2 2026 (50).
Education ransomware attacks increased 39% from Q3 2025 to Q3 2026.
Education median ransom demanded in Q3 2026 was $510,000 with an average of $645,100.
Five education entities confirmed they had not paid a ransom in Q3 2026, and none were confirmed to have paid.
Business sector ransomware attacks increased from 1,753 in Q2 2026 to 2,234 in Q3 2026, a 27% rise.
Businesses recorded 2,234 ransomware attacks in Q3 2026 in total, with 138 confirmed and 2,096 unconfirmed.
Manufacturers were the most targeted by ransomware with 478 attacks in Q3 2026, a 22% increase from Q2 2026 (391).
Transportation company ransomware attacks jumped 118% from 34 in Q3 2025 to 74 in Q3 2026.
Manufacturers saw ransomware attacks increase 52% year‑over‑year (Q3 2025 to Q3 2026).
The top ransom demand in Q3 2026 was $12.3 million issued to Stadler Rail (Switzerland).
Qilin and The Gentlemen had the most confirmed attacks with 27 and 26 confirmed attacks, respectively.
Saber Healthcare Group (US) reported 427,084 people affected by a Q3 2026 ransomware attack.
Arbeiterkammer (Austrian Chamber of Labour) reported approximately 270,000 people affected by a Q3 2026 breach.
Construction sector attacks declined by 2% from Q2 2026 to Q3 2026.
Government attacks increased 80% from Q3 2025 (69) to Q3 2026 (124).
Of the 247 confirmed Q3 2026 attacks, 20 were on educational institutions.
Q3 2026 had 2,380 unconfirmed ransomware attacks.
Of the 2,380 unconfirmed Q3 2026 attacks, 152 were on healthcare companies.
Qilin and The Gentlemen had the most confirmed attacks out of their claims with 27 and 26 confirmed attacks, respectively.
Ransomware attacks in the US increased 34% from Q2 2026 to Q3 2026.
Twelve government entities confirmed they had not paid a ransom in Q3 2026, and no government entities were confirmed to have paid.
Healthcare ransomware attacks increased 102% from Q3 2025 (93) to Q3 2026 (188).
Education sector in Q3 2026 had 75 ransomware attacks in total, with 20 confirmed and 55 unconfirmed.
Tech companies recorded a 132% increase in ransomware attacks from Q3 2025 (113) to Q3 2026 (262).
The Government of Berlin faced a $2.3 million ransom demand in Q3 2026.
Clop increased attacks by 4,700%, from 1 attack in Q2 2026 to 48 attacks in Q3 2026.
Q3 2026 saw 2,627 ransomware attacks in total, averaging nearly 29 attacks per day.
The US experienced 1,066 ransomware attacks in Q3 2026, representing 41% of all attacks.
DireWolf increased attacks by 1,450% from Q2 2026 to Q3 2026.
Germany recorded 121 ransomware attacks in Q3 2026, a 22% increase from Q2 2026 (99).
Canada recorded 103 ransomware attacks in Q3 2026, a 4% increase from Q2 2026.
India saw ransomware attacks rise 116% from Q2 2026 (37) to Q3 2026 (80).
From Q2 2026 to Q3 2026, government entity attacks increased 36%, rising from 91 to 124 ransomware attacks.
Business sector attacks increases 27% from Q2 2026 to Q3 2026.
Q3 2026 ransomware attacks increased by 29% to 2,627 from 2,030 in Q2 2026.
Government median ransom demand in Q3 2026 was $60,000 with an average of $358,000.
Argentina saw ransomware attacks rise 150% from Q2 2026 (18) to Q3 2026 (45).
Over 641 TB of data was stolen across all Q3 2026 ransomware attacks.
Legal firms saw a 26% decrease in ransomware attacks from Q2 2026 to Q3 2026.
Q3 2026 ransomware attacks increased by 61% to 2,627 from 1,636 in Q3 2025.
Healthcare attacks increased 39% from Q2 2026 to Q3 2026.
Median ransom demand in Q3 2026 was $150,000 with an average demand of $602,400.
Qilin made 357 attack claims and The Gentlemen made 342 attack claims in Q3 2026.
Healthcare businesses saw ransomware attacks increase 95% year‑over‑year (Q3 2025 to Q3 2026).
Technology industry ransomware attacks increased 70% from Q2 2026 to Q3 2026.
Of the 247 confirmed Q3 2026 attacks, 53 were on government entities.
Of the 2,380 unconfirmed Q3 2026 ransomwre attacks, 2,096 were on businesses.
Qilin recorded 357 ransomware attacks in Q3 2026 and increased attacks by 24% from the previous quarter.
Government attacks increased 36% from Q2 2026 to Q3 2026.
Businesses operating in the healthcare sector saw ransomware attacks rise 35% from Q2 2026 to Q3 2026.
Confirmed ransomware attacks in Q3 2026 compromised 1,611,971 records in total.
A total of 262 tech companies were targeted by ransomware in Q3 2026, a 70% increase from Q2 2026 (154).
Finance organizations saw ransomware attacks rise 72% from Q2 2026 (116) to Q3 2026 (199).
Utility company attacks increased 32% from Q2 2026 to Q3 2026.
Of the 2,627 ransomware attacks in Q3 2026, 247 were confirmed attacks.
Healthcare sector in Q3 2026 had 188 ransomware attacks in total, with 36 confirmed and 152 unconfirmed.
Healthcare median ransom demanded in Q3 2026 was $300,000 with an average of $528,000.
Five healthcare entities confirmed they had not paid a ransom in Q3 2026, and none were confirmed to have paid.
Kreishandwerkerschaft Borken (Germany) faced a $674,000 ransom demand in Q3 2026.
Business sector ransomware attacks increased 58% from Q3 2025 to Q3 2026.
Business sector median ransom demanded in Q3 2026 was $100,000 with an average of $651,500.
Retailers saw ransomware attacks increase 97% year‑over‑year (Q3 2025 to Q3 2026).
SAD’S Intérim (France) faced a $630,000 ransom demand in Q3 2026.
Greenberg Traurig, LLP (US) notified 150,000 people of a Q3 2026 breach.
Ryomo Systems (Japan) reported 127,789 people affected by a Q3 2026 breach (including 124,000 for Daito Gas and 3,789 for Isesaki City).
AngMar Management Services (US) notified 126,196 people affected by a Q3 2026 breach.
Rhysida increased attacks by 200% from Q2 2026 to Q3 2026.
Akira's attacks declined by 23% from Q2 2026 to Q3 2026.
LockBit's attacks declined by 51% from Q2 2026 to Q3 2026.
Italy recorded 86 ransomware attacks in Q3 2026, a 32% increase from Q2 2026.
Eleven business entities confirmed they had not paid a ransom in Q3 2026 (one is rumored to have negotiated).
The Gentlemen recorded 342 attacks in Q3 2026 and increased attacks by 29% from the previous quarter.
General Santos Doctors Hospital (Philippines) faced a $617,400 ransom demand in Q3 2026.
Twenty-eight companies disclosed the number of people impacted in Q3 2026 ransomware attacks, confirming over 1.6 million people impacted in total.
Finance industry ransomware attacks increased 72% from Q2 2026 to Q3 2026.
Education attacks increased 50% from Q2 2026 to Q3 2026.