Report by Fortinet
2026 Global Threat Landscape Report
Key Findings
There were 7,831 confirmed ransomware victims globally, a 389% year-over-year increase from approximately 1,600 victims previously.
Brute force attempts decreased 22% year-over-year.
Within dark web "database" activity, stealer logs comprised 67.12% of advertised/shared datasets, combolists 16.47%, and leaked credentials 5.96%.
Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).
The top three targeted sectors by ransomware victims were manufacturing (1,284), business services (824), and retail (682).
Ransomware victims concentrate geographically with the U.S. at 3,381, Canada at 374, and Germany at 291.
Global exploitation attempts increased 25.49% year-over-year.
Time-to-exploit (TTE) is 24–48 hours for critical outbreaks, compared to 4.76 days previously.