Ransomware stays near record levels, led by Qilin and The Gentlemen
September, 2026 (August and September 2026)
NCC Group counted 1,073 ransomware victims in August, a 2026 high. Breachsense counted 964 for August and 789 for September across 79 active groups, so totals differ by method. Qilin (164 incidents) and The Gentlemen (116) led in August. Healthcare was the most targeted sector in September for the fourth month in a row, and the United States accounted for 41% of victims.
Why it matters
These counts only include victims listed on leak sites. Many victims pay before being listed, so real numbers are higher.
What defenders can take from it
- Keep offline, tested backups and require multi-factor authentication on all remote access.
- Rehearse your incident response plan, including who decides about payment.