Q3 2026 Sets New Record for Ransomware Attacks

Ransomware attacks reached their highest ever quarterly volume in the third quarter of 2026, according to an analysis by Comparitech.

The firm identified a total of 2627 claimed attacks during the three-month period from July to September 2026. This is a 27% increase on the previous quarter, Q2 2026, and a 61% rise compared to Q3 2025.

The finance and technology sectors experienced the biggest growth in ransomware incidents in Q3 compared to Q2 2026, up by 72% and 70%, respectively.

Other critical sectors faced a significant rise in attacks, including education (up 50%), healthcare (39%), government (36%) and utilities (32%).

Of the 2627 attacks claimed by ransomware groups in Q3, 247 have been confirmed by the entity involved, Comparitech found.

Rebecca Moody, head of data research at Comparitech, said that the figures are highly unusual, and represent a significant cause for concern.

"I'm often asked what I think lies ahead in the ransomware threat landscape, and it's notoriously difficult to predict. Figures frequently fluctuate and a sector might see a bit of an increase one month, only to see a slight decrease the next month. However, Q3 2026 is different. We're not seeing slight increases or decreases. We're seeing significant increases across all key sectors,” she noted.

Read now: Ransomware Attacks Reach Record High for 2026

A possible explanation for the surge is developments in AI technology, which is enabling ransomware attackers to increase the scale and speed of campaigns, as well as their effectiveness.

In July, researchers identified the JadePuffer campaign, believed to be the world’s first ransomware attack completely driven by AI.

Attackers Move to Triple Extortion

The report highlighted an increase in attackers using triple extortion tactics on victim organizations. In this model, in addition to encrypting systems and exfiltrating data, threat actors also target individuals impacted in the attack.

“A prime example is The Gentlemen's recent attack on MIP Holdings (a South African tech company). After being targeted by the group in June 2026, MIP paid a ransom to have stolen data deleted. Over the last few weeks, however, The Gentlemen has started adding MIP's clients to its data leak site in a bid to get a ransom out of them, too,” Moody said.

She added that this tactic further demonstrates that paying a ransom is no guarantee that the attacker will keep to their word regarding deleting stolen data.

The Comparitech report, published on October 7, found that the average ransomware demand in Q3 was $602,400.

The most hefty demand known to be issued in the period was $12.3m, against Swiss-based railway manufacturing firm Stadler Rail by Everest in July 2026. Stadler refused to pay the demand and Everest proceeded to leak 201 GB of stolen data.

This was followed by Rhysida demanding $2.3m from the State of Berlin after compromising the authority’s network. The group subsequently published 5.7 TB of stolen data, including personal information of citizens, after the state government publicly refused to pay.

Qilin and The Gentlemen Dominate Ransomware Activity

Qilin and The Gentlemen were the most prolific ransomware groups in Q3, claiming 357 and 342 attacks, respectively. This represented a 24% rise in activity by Qilin and 29% for The Gentlemen compared to Q2.

Clop increased its volume of attacks by 4700%, from one attack in Q2 to 48 in Q3.

Read now: ShinyHunters Claim Hack of Rival Ransomware Gang Clop

There was also a big rise in claimed attacks by Direwolf during the same period, up by 1450%.

The country with the highest number of attacks in Q3 was the US at 1066, 41% of the total. This represented a 34% rise from Q2. This was followed by Germany with 121 attacks, up by 22%.

Argentina and India experienced the biggest jump in claimed attacks in Q3 compared to Q2, rising by 150% and 116%, respectively.