Global Cyber Attacks Surge Amid Rising Threats: A September Update
In September 2026, organizations around the globe experienced an alarming average of 2,803 cyber attacks per week, marking a significant increase of 16% from August and a staggering 48% rise compared to the same month the previous year. This data, reported by Check Point Research, suggests a concerning trend in cyber security that extends beyond momentary fluctuations in threat levels. Over the past five months, the frequency of weekly attacks per organization has surged by 36%, escalating from an average of 2,055 in May.
UK organizations specifically faced an average of 1,920 attacks weekly, demonstrating a remarkable 50% year-on-year increase. Notably, Europe has shown the fastest growth in cyber attacks of any region, with an increase of 61%. Meanwhile, Latin America recorded the highest volume of attacks, with an average of 3,813 per organization per week, followed closely by Africa (3,701) and the Asia-Pacific (APAC) region, which saw 3,593 attacks in the same timeframe.
Barnaby Nickels, regional manager for exposure management in the UK and North EU at Check Point, commented on the data, stating, "September’s data shows cyber risk increasing in both volume and breadth." This statement underscores the pervasive nature of the threat faced by organizations worldwide.
Education Sector Targets Rise Dramatically
As the academic year commenced, the education sector emerged as the most targeted industry, facing an average of 6,656 attacks weekly per organization. This figure represents a 59% increase year-on-year and a 24% rise compared to August, emphasizing the vulnerabilities that educational institutions face as students, staff, and parents reconnect to their networks. Following education, the telecommunications sector ranked second globally with an average of 3,483 attacks per week, up 29%, while government organizations faced 3,443 attacks, reflecting a 37% increase.
In the UK specifically, the education and government sectors were again identified as the primary targets, followed by the media and entertainment sector, energy and utilities, and software companies, all of which are increasingly facing cyber threats.
Escalation in Ransomware Attacks
The month of September witnessed a notable spike in ransomware incidents, with a total of 824 attacks recorded on double-extortion groups’ leak sites. This marked a 53% increase from the same period in 2025. Among these attacks, "The Gentlemen" emerged as the most active ransomware group, responsible for 13% of all published attacks. Other notable groups included Qilin at 9% and Akira at 5%. A total of 80 extortion groups contributed to the attacks during this month, showcasing the escalating threat landscape.
Founded in mid-2025, "The Gentlemen" operates as a ransomware-as-a-service (RaaS) provider and has rapidly gained prominence by supporting various operating environments, including Windows, Linux, and ESXi.
Business services accounted for 31.3% of reported victims, followed by the consumer goods and services sector at 15.2%, and industrial manufacturing at 11.0%. It is important to note that companies providing business services often handle data or system access for multiple clients, which means that a single incident can have far-reaching consequences beyond the initial victim. Geographically, North America constituted 46% of reported incidents, with Europe accounting for 25% and APAC for 17%.
Increase in Phishing Attacks
In addition to the surge in ransomware, phishing attacks are also on the rise. September data revealed that 1.1% of emails were classified as phishing attempts, a notable increase from 0.89% in August. Malicious links were identified as the primary method for these attacks, present in 81% of phishing emails, while 11% included attachments. The remaining phishing attempts relied solely on social engineering tactics.
Particularly affected by this increase, the associations and nonprofit sector reported the highest phishing rate, with 2.17% of emails categorized as malicious, which is approximately double the global average. Following this, the construction and engineering sector recorded 2.05%, and the real estate, rentals, and leasing sector had a rate of 1.38%. North America also emerged as the most affected region, with 1 in 79 emails classified as malicious.
Concerns Over GenAI Use
The growth of Enterprise GenAI usage has introduced new concerns regarding data security. In September, the average user generated 131 prompts, with organizations utilizing an average of eight tools. Alarmingly, 1 in every 39 prompts posed a high risk of sensitive data leakage, impacting 89% of organizations engaged in regular GenAI use. Network and IT infrastructure data was the most commonly exposed type, affecting 71% of organizations, followed closely by financial data (70%), legal and regulatory data (68%), employee and HR data (62%), and personally identifiable information (60%).
Business services had the highest rate of high-risk prompts, with 1 in 20 posing potential threats. This was followed by financial services (1 in 25) and healthcare and medical sectors (1 in 29).
In light of the rising tide of cyber threats, Nickels concludes, "With attacks rising across every region, phishing becoming more frequent, ransomware remaining elevated, and GenAI use expanding alongside sensitive-data exposure, security teams cannot rely on fragmented defenses." He emphasizes the need for a prevention-first approach, one that integrates visibility, control, and automation across multiple platforms to proactively combat these threats before they disrupt operations or compromise sensitive information.
For more detailed insights, the complete September 2026 report is accessible online through Check Point’s official channels.