Ransomware · Threat Intelligence
Ransomware Attacks Reach Record Highs in Q3 2026, Report Finds
A new report says ransomware attacks hit an all-time high in Q3 2026, with critical sectors like finance and healthcare especially affected. Attackers are demanding more money and using new tactics.
Ross GrantUpdated 3 min read
The short version
A new report says ransomware attacks hit an all-time high in the third quarter of 2026. Attackers are not only demanding more money but also using new tactics, like targeting individuals and using AI to automate attacks. Critical sectors such as finance, healthcare and education have been especially affected. Paying a ransom does not guarantee your data will be safe.
By the numbers
- 2,627claimed ransomware attacks in Q3 2026Infosecurity Magazine
- $602,400average ransom demand in Q3 2026Infosecurity Magazine
- $12.3mlargest known ransom demand (Stadler Rail)Infosecurity Magazine
- 201 GBdata leaked after Stadler Rail refused ransomInfosecurity Magazine
- 5.7 TBdata leaked after State of Berlin refused ransomInfosecurity Magazine
- 4,700%increase in Clop group attacks from Q2 to Q3Infosecurity Magazine
What happened?
A report from Comparitech, cited by Infosecurity Magazine, says ransomware attacks hit a new record in Q3 2026, with 2,627 claimed incidents. Critical sectors like finance, technology, education and healthcare saw significant increases. Attackers are demanding higher ransoms and using new tactics, including AI-driven campaigns and triple extortion.
Ransomware Surge in Q3 2026
Ransomware attacks reached their highest level yet in the third quarter of 2026, according to a report from Comparitech cited by Infosecurity Magazine (opens in a new tab). The report counted 2,627 claimed ransomware attacks between July and September. Sectors hit hardest included finance, technology, education and healthcare.
The increase is not just in the number of attacks. Attackers are also demanding higher ransoms and using more aggressive tactics to pressure victims into paying.
New Tactics: Triple Extortion and AI
The report highlights a shift in how ransomware groups operate. One major trend is the use of triple extortion. In this approach, attackers not only lock up a victim organisation's systems and steal data, but also go after individuals affected by the breach. For example, after attacking South African tech firm MIP Holdings in June, the group known as The Gentlemen demanded a ransom to delete stolen data. When MIP paid, the group then targeted MIP's clients, posting their details online and demanding further payments.
Another development is the use of artificial intelligence (AI) to automate and scale attacks. In July, researchers identified the JadePuffer campaign, which is believed to be the first ransomware attack driven entirely by AI. This could make future attacks faster and harder to stop.
Ransom Demands and Notable Incidents
The average ransom demand in Q3 was $602,400. The largest known demand was $12.3 million, made by the Everest group against Swiss railway manufacturer Stadler Rail. Stadler refused to pay, and Everest leaked 201 GB of stolen data. Another major case involved the Rhysida group, which demanded $2.3 million from the State of Berlin. When the government refused, the attackers published 5.7 TB of data, including personal information of citizens.
Most Active Ransomware Groups
Two groups, Qilin and The Gentlemen, were the most active in Q3. Qilin claimed 357 attacks, a 24% increase from the previous quarter. The Gentlemen claimed 342 attacks, up 29%. Another group, Clop, increased its activity dramatically, from just one attack in Q2 to 48 in Q3, a 4,700% jump.
What to Do if Your Organisation is Targeted
Experts warn that paying a ransom does not guarantee stolen data will be deleted or that attackers will keep their promises. Organisations should focus on prevention: keep backups, patch systems regularly, and train staff to spot suspicious emails. If attacked, report the incident to authorities and seek professional help before making any decisions about ransom payments.
What We Still Don't Know
This report is based on secondary reporting from Infosecurity Magazine, citing Comparitech. There is no primary source or official confirmation yet. The exact methods used in the AI-driven attacks and the full impact on affected organisations are not yet clear.
Claimed vs confirmed
- Unconfirmed
Ransomware attacks reached a record high of 2,627 in Q3 2026.
Reported by Infosecurity Magazine citing Comparitech; no primary source or official confirmation yet.
- Unconfirmed
AI-driven ransomware campaigns are increasing the scale and speed of attacks.
Mentioned in the report, but no technical details or independent confirmation provided.
- Unconfirmed
Triple extortion tactics are being used to target individuals as well as organisations.
Described in the report, with the MIP Holdings case as an example, but not confirmed by primary sources.
The impact
- Money
- The average ransom demand was $602,400, with the largest known demand at $12.3 million. Organisations could face significant costs, including possible fines under data protection laws if personal data is exposed.
- Reputation
- Organisations hit by ransomware may suffer loss of trust, especially if attackers leak sensitive data. High-profile incidents can damage a company's reputation and affect relationships with clients and the public.
- Customers
- Customers and individuals whose data is stolen may be at risk of identity theft or fraud. They should watch for notifications from affected organisations and take steps to protect their information, such as changing passwords and monitoring accounts.
Why it matters
Ransomware can disrupt essential services, put sensitive data at risk and cost organisations millions. The rise in attacks and new tactics means more people and businesses could be affected. Understanding these trends helps organisations prepare and protect themselves.
How does it work?
Ransomware is malicious software that locks up a victim's files or systems and demands payment for their release. Triple extortion adds extra pressure by threatening to leak stolen data and targeting individuals affected by the breach. AI-driven campaigns use artificial intelligence to automate and scale attacks, making them faster and more effective.
Key points
- Ransomware attacks reached a record high in Q3 2026, with 2,627 claimed incidents.
- Attackers are using new tactics like triple extortion and AI-driven campaigns.
- Average ransom demand was $602,400, with some demands exceeding $12 million.
- Paying a ransom does not guarantee data will be deleted or kept private.
- Critical sectors such as finance, healthcare and education are especially at risk.
Sources
Infosecurity Magazine
Reference
- Q3 2026 Sets New Record for Ransomware Attacks (opens in a new tab)
infosecurity-magazine.com
- Q3 2026 Sets New Record for Ransomware Attacks (opens in a new tab)
