Ransomware News: Record Attacks, New Groups and Big Breaches (Autumn 2026)

The numbers: a record autumn

Ransomware hit new highs. Comparitech counted 2,627 claimed attacks in Q3 2026, its highest quarter on record and up 27% on Q2. Check Point counted 1,063 attacks in October, its highest month so far. Each tracker counts in its own way, and Q3 estimates range from about 2,600 to 2,900. But they all point the same way.

Finance (up 72% on the previous quarter) and tech (up 70%) were among the fastest-growing targets, according to Comparitech.

The biggest incidents

Not every attack below was ransomware. Some were large thefts or data leaks. Together they show who is being targeted and what it costs.

Two lessons stand out. First, crypto exchanges were hit hardest, and state-backed hackers with large budgets are among those behind it. The FBI blamed North Korea for the Binance theft. Elliptic, a firm that traces crypto payments, judged a North Korea link for Bitget highly likely. Second, the IDC Frontier attack is a reminder that your cloud provider's backups are not your backups. Affected customers were told to restore from their own copies.

Who is behind the attacks

• Qilin and The Gentlemen were the two most active ransomware gangs in Q3, with 357 and 342 claimed victims per Comparitech. Which one ranks first depends on the tracker.
• n0n appeared in September. It uses AI tools and gets in through weak or stolen passwords. It claims more than 170 victims, including an unconfirmed claim against DraftKings advertising data.
• North Korean groups were behind the largest thefts of the year from crypto exchanges.

Gangs post claims on their own leak sites, and many are never confirmed by the victim. Comparitech found that only 247 of the 2,627 Q3 claims were confirmed. So treat single claims with caution.

How attackers are getting in

Knowing how attackers get in tells you where to spend first. Coveware's Q3 figures, reported by Veeam, show the main ways in:

In October, the FBI and Secret Service warned about "FortiBleed". More than 86,000 FortiGate firewalls were broken into by attackers trying leaked passwords and common passwords across many accounts. The access was then sold on to ransomware gangs. See our list of exploited vulnerabilities to patch now.

Extortion is changing

Data theft is now the main threat. Coveware saw data stolen in 71% of Q3 cases. Files were locked or systems disrupted in about half. Fewer victims pay: nearly 80% of cases ended without a payment. But the median payment rose to about $400,000.

So good backups alone are no longer enough. You also need to spot attackers before they take the data.

What to do this month

1. Turn on phishing-resistant MFA (a second login step, such as a passkey, that fake sites cannot steal) for email, VPN and admin accounts. Block mass password guessing with lockouts and login rules.
2. Patch internet-facing devices within days, and check exploited ones for a break-in.
3. Keep offline or locked backups that you control, and test a restore.
4. Watch for data leaving your network, not just for locked files. 24/7 monitoring is what catches attackers at 3 a.m.
5. Write down and rehearse your incident response plan.

Phishing (fake emails that trick people into clicking or sharing passwords) is still the most common way in. Learn how to spot a phishing email.