Ransomware Statistics

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.

Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.

7% of reported cybercrime cases in Africa in 2025 involved ransomware or Banking Trojan stealers.

The highest ransom demand in Q2 2026 was $25 million.

Qilin accounted for 285 undisclosed attacks (14%), The Gentlemen accounted for 219 (11%), and Dragon Force accounted for 137 (7%) in Q2 2026.

The number of undisclosed ransomware attacks fell 6% compared to the previous quarter.

41% of ransomware attacks exploited brand reputation.

35% of ransomware attacks exploited employee data.

31% of ransomware attacks exploited intellectual property.

Ransomware incidents made up over 20% of Cisco Talos Incident Response engagements this quarter, similar to just under 20% last quarter.

Threat actors maintained undetected access for approximately three days before ransomware deployment in the observed Sinobi engagement.

Q2 2026 recorded 1,988 ransomware attack claims from 89 groups across 101 countries.

The US accounted for 42.5% of ransomware claims, Canada for 5% and Germany for 4.8%.

Qilin was responsible for 293 attack claims in Q2 2026, though its volume slid each month, from 113 in April to 108 in May and 72 in June.

80% (12 out of 15) of The Gentlemen’s attack claims were against higher education institutions.

Of 104 ransomware attacks on educational institutions in H1 2026, 36 were confirmed by the targeted entities.

There were 104 ransomware attacks in total against educational institutions in H1 2026.

Ten ransomware families were active against manufacturing networks in H1 2026.

28% of global organizations that experienced a ransomware attack report that AI significantly increases the attack's effectiveness.

37% of global organizations that experienced a ransomware attack report that AI somewhat increases the attack's effectiveness.

Only 9% of global organizations affected by ransomware report no evidence of AI use in the attack.

The Zhen ransomware family generated 22.2 million hits concentrated on just two devices in manufacturing networks.

26% of organisations cite ransomware as one of their top three challenges over the next five years.

The five largest ransomware actors controlled 43.6% of all victims.

7,551 publicly disclosed ransomware victims were identified between April 1, 2025 and March 31, 2026, a 24.9% increase from the previous reporting period.

There were 146 active ransomware groups by June 2026, including 61 new groups entering during the reporting period.

Ransomware attack claims increased 25% to 4,544 incidents during the first half of 2026, averaging 25 attacks per day.

Active ransomware groups increased 16% to 103 worldwide during the first half of 2026.

In H1 2026, one government entity confirmed it paid a ransom while 16 government entities said they did not pay.

The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1.

The Gentlemen posted 101 victims in April, 77 in May, and 122 in June.

Deadlock emerged in June 2026 with 75 named victims in a single month.

The median ransom demand in H1 2026 was $100,000, which is one-fifth of the H2 2025 median of $500,000.

The United States accounted for 31% of government ransomware attacks in H1 2026, with 58 of the 187 attacks, representing a 23% decline from 75 attacks in H2 2025.

51% of organizations that pay the ransom negotiate a lower amount than the initial demand.

Brute-force attacks accounted for 6% of ransomware incidents.

Compromised credentials accounted for 23% of ransomware incidents.

The five most prolific ransomware groups collectively claimed more than 40% of all recorded attacks.