Ransomware attacks surged to unprecedented levels in the third quarter of 2026, reaching the highest volume ever recorded for any quarter, as noted in a comprehensive analysis by Comparitech. The reported analysis revealed a staggering total of 2,627 claimed ransomware incidents between July and September 2026. This figure represents a notable 27% increase compared to the previous quarter (Q2 2026) and an alarming 61% rise when juxtaposed with the same quarter from the previous year (Q3 2025).
Among various sectors, finance and technology exhibited the most pronounced growth in ransomware incidents during this quarter, with increases of 72% and 70% respectively. Other critical sectors did not escape unscathed, as sectors like education, healthcare, government, and utilities also faced significant upticks in attacks. Education saw a 50% increase, healthcare experienced a 39% rise, government faced a 36% increase, while utilities observed a 32% surge in attacks.
Out of the 2,627 claimed attacks, Comparitech confirmed that 247 incidents had been validated by the affected entities. Rebecca Moody, the head of data research at Comparitech, expressed significant concern regarding the uptick in ransomware incidents. She elaborated that unlike previous fluctuations observed in the ransomware threat landscape, the figures for Q3 2026 signified not just minor increases or decreases, but rather substantial and alarming rises across all key sectors. Moody emphasized the challenge in predicting the trajectory of ransomware threats, making the current figures “highly unusual.”
A potential reason behind this alarming rise may be advances in artificial intelligence (AI) technology, which has bolstered the capabilities of ransomware attackers. This technological evolution has enabled attackers to execute campaigns with increased speed, scale, and effectiveness. Noteworthy is the identification of the JadePuffer campaign in July 2026, which is considered to be the world’s first ransomware attack entirely driven by AI.
Moreover, the report highlighted a concerning trend of ransomware attackers adopting “triple extortion” tactics. In this increasingly sophisticated model, attackers not only encrypt the systems and siphon off sensitive data but also target individuals connected to the compromised organizations. An illustrative case of this tactic is presented through the attack on MIP Holdings, a South African tech company. After MIP paid a ransom to delete the stolen data, the attackers subsequently began leaking information about MIP’s clients on a data leak site as part of their new extortion strategy. This tactic underscores the message that paying a ransom does not assure victims of the attackers’ commitment to destroying stolen data, making the threat landscape even more precarious.
The Comparitech report, released on October 7, additionally revealed that during Q3 2026, the average ransom demand reached $602,400. Notably, the highest ransom demand recorded in this timeframe was an astonishing $12.3 million, made by the Everest group against Stadler Rail, a Swiss-based railway manufacturing firm. Stadler refused to comply with the demand, leading Everest to leak a substantial 201 GB of stolen data. Another significant case involved the Rhysida group, which demanded $2.3 million from the State of Berlin after breaching the authority’s network. After the state government declined to pay, the group published 5.7 TB of stolen data, including personal information of citizens, further complicating the situation.
During Q3, the ransomware landscape was dominated by the groups Qilin and The Gentlemen, which were responsible for 357 and 342 attacks respectively. This represented a 24% increase in activity for Qilin and a 29% rise for The Gentlemen compared to the preceding quarter. The volume of attacks by the Clop group saw an astounding increase of 4,700%, escalating from a mere one attack in Q2 to 48 in Q3. Additionally, the Direwolf group reported a significant rise in claimed attacks during the same period, increasing by an impressive 1,450%.
Geographically, the United States suffered the highest number of ransomware attacks in Q3, tallying 1,066 attacks—41% of the total worldwide. This marked a 34% increase from Q2. Following the U.S., Germany faced 121 attacks, corresponding to a 22% rise. Latin American nations such as Argentina and India experienced particularly steep increases, with claimed attacks surging by 150% and 116%, respectively.
In summary, the findings underscore a troubling trend in the cybersecurity landscape as ransomware attacks escalate in both volume and sophistication. As attackers continue to adapt their strategies, the implications for affected sectors and individuals remain severe, necessitating increased vigilance and enhanced cybersecurity measures across industries and borders.