Ransomware Attacks Hit Global Record High in August 2026

Ransomware attacks reached a global record high in August 2026, continuing a sharp upward trend that has defined the year. Multiple cybersecurity firms reported a surge in activity, with one firm, CYBEROO CERT, logging 1,165 incidents, a 128% increase compared to the same month in the previous year.

The scale of the increase was documented across the industry, though specific totals varied based on different data collection methods. According to research from Comparitech, there were 997 ransomware attacks worldwide in August, averaging 32 attacks per day. This was a 23% increase from July 2026 and surpassed the previous monthly record of 988 attacks set in February 2025. Similarly, NCC Group's August 2026 Cyber Threat Intelligence Report identified 1,073 ransomware attacks, a 12% jump from the month prior and a new peak for the year. Cyble noted a cumulative 101% rise in ransomware volume over July and August combined.

These figures are part of a sustained, multi-year escalation. A report from Black Kite covering the 12 months from April 2025 to March 2026 documented 7,551 victims, a 24.9% year-over-year increase and the fourth consecutive year a new high was set. The data also showed an acceleration, with the second half of that period outpacing the first by 60%. While ransomware groups claimed responsibility for hundreds of attacks in August, Comparitech noted that many of these claims remain unconfirmed by the victims themselves. Of the 997 incidents it tracked, 77 were independently verified through public disclosures, while the remaining 920 were based on claims made on data leak sites.

Who Was Hit Hardest?

The surge in attacks was felt across most industries and regions, though certain sectors experienced particularly sharp increases. "Ransomware threats are escalating across most sectors and continue to have a devastating impact on those affected," said Rebecca Moody, head of data research at Comparitech. The industrial sector remained the primary target, accounting for 31% of all attacks in August, according to NCC Group.

Targeted Industries

While industrials bore the brunt of the volume, other sectors saw alarming growth in attack frequency. "The healthcare sector saw a 30 percent increase in attacks, but utility companies saw the biggest spike," Moody stated. Attacks on healthcare providers rose from 53 incidents in July to 69 in August. The increase for utility companies was even more stark, with attacks doubling from five in July to ten in August.

Other professional sectors also saw significant upticks. According to Comparitech's data, attacks on law firms increased by 52%, while those targeting tech companies and finance companies rose by 42% and 40%, respectively.

Geographic Hotspots

The attacks were geographically concentrated in Western nations. North America was the most targeted region, accounting for 44% of all incidents recorded by NCC Group. The United States alone was the victim in nearly 42% of the total attacks tracked by Comparitech. Europe was the second most affected region, experiencing over a quarter (26%) of the attacks.

The Groups Behind the Surge

A handful of prolific ransomware groups were responsible for a significant portion of the August attacks. The group known as Qilin was consistently identified as one of the most active threats. NCC Group attributed 15% of all attacks, or 164 incidents, to Qilin. Comparitech reported that Qilin claimed 157 incidents, while another group, The Gentlemen, claimed 107, with the two collectively accounting for over 26% of the month's total.

Rankings of the most active groups can differ between security firms. Arete Incident Response, for example, observed INC Ransom as the most active threat actor in August, followed by Storm, DragonForce, Qilin, and The Gentlemen. The landscape is also constantly changing, with Arete identifying several previously untracked ransomware groups emerging in August, including Storm, Dark Project, and Spirals, among others. This constant evolution highlights the dynamic nature of the ransomware ecosystem, where new groups emerge as others are disrupted or rebranded.

What Is Driving the Trend?

Experts attribute the record-breaking month to several factors, including the increasing sophistication of attackers' tools and the persistent resilience of their operations. "August was the second consecutive month of highest ransomware levels for the year, indicating a steady rise in global activity," said Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group. Hull linked the increase to "rapid advancements in AI and ongoing geopolitical volatility."

The Growing Role of AI

The use of artificial intelligence by threat actors is a key factor in the evolving threat. Security researchers observed the continued integration of AI-enabled capabilities across the ransomware ecosystem in August. These tools are used for tasks such as the automated analysis of large volumes of stolen data to identify the most valuable information for extortion. AI-driven chatbots are also being used to manage communications with victims during ransom negotiations. NCC Group also pointed to incidents like the one involving OpenAI and Hugging Face as examples of the new security challenges posed by autonomous AI systems.

Operational Resilience

The record numbers also underscore the operational resilience of major ransomware operations. Despite high-profile law enforcement actions aimed at disrupting their infrastructure, groups like LockBit have demonstrated an ability to recover and resume their attacks. This resilience is often attributed to their decentralized affiliate models, which allow the core developers to survive takedowns of specific servers or the arrests of individual operators. As long as the business model remains profitable, the threat actors have proven adept at rebuilding and evolving their tactics.