Report by GuidePoint Security
GRIT Q1 2026 Ransomware & Cyber Threat Insights Report
5 FINDINGSPublished Apr 15, 2026
View Original Report →Key Findings
The Gentlemen ransomware group increased from 35 victims in Q4 2025 to 182 victims in Q1 2026.
RansomwareThreat ActorsRaaSThe Gentlemen
The construction industry experienced 131 ransomware victims in Q1 2026, a 44% year-over-year increase.
RansomwareConstructionRansomware Industry Impact
51% of observed ransomware victims in Q1 2026 were based in the United States; the United Kingdom and Canada each accounted for 4%.
RansomwareRansomware GeographyCanadaUSUK
Ransomware victim post rates averaged approximately 150–200 per week in Q1 2026 and remained steady quarter-over-quarter and year-over-year.
RansomwareThreat ActivityRansomware Victim Post Rates
Activity from the Qilin ransomware group declined by 25% and activity from the Akira ransomware group declined by 22%.
RansomwareThreat ActorsRaaSQilinAkira