Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.
Cisco Talos observed 90 ransomware incidents against Japanese organizations from January to July 2026, up about 4.7% year over year, with manufacturing accounting for 34% of victims. The Gentlemen was the most active group with 14 incidents; its leak-site listings grew from 48 in January to 105 in July. Qilin and SafePay followed with seven incidents each, and Talos notes Qilin is leveraging AI to improve operational efficiency.
- 90 Japanese organizations hit January–July 2026; average 13 incidents monthly
- The Gentlemen leak-site listings rose 2.2x, from 48 in January to 105 in July
- Firms capitalized under JPY 1 billion represent about 78% of victims
- Manufacturing most affected at 34%, then information/communications at 11%
- The Gentlemen operates RaaS with double extortion; possible Russian-speaking involvement
- Vendors
- Cisco Talos
- Countries
- JapanTaiwanUnited StatesPhilippines
From the original article
13 min read at blog.talosintelligence.com
Ransomware incidents in Japan rose 4. 7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July.
By Takahiro Takeda · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.