Report by GuidePoint Security
GRIT Q1 2026 Ransomware & Cyber Threat Insights Report
5 FINDINGSPublished Apr 15, 2026
View Original Report →Key Findings
The construction industry experienced 131 ransomware victims in Q1 2026, a 44% year-over-year increase.
RansomwareConstructionRansomware Industry Impact
The Gentlemen ransomware group increased from 35 victims in Q4 2025 to 182 victims in Q1 2026.
RansomwareThreat ActorsRaaSThe Gentlemen
51% of observed ransomware victims in Q1 2026 were based in the United States; the United Kingdom and Canada each accounted for 4%.
RansomwareRansomware GeographyCanadaUSUK
Activity from the Qilin ransomware group declined by 25% and activity from the Akira ransomware group declined by 22%.
RansomwareThreat ActorsRaaSQilinAkira
Ransomware victim post rates averaged approximately 150–200 per week in Q1 2026 and remained steady quarter-over-quarter and year-over-year.
RansomwareThreat ActivityRansomware Victim Post Rates