August 2026 closed with 1,056 recorded ransomware attacks across 83 active groups in 79 countries, up from 937 attacks and 67 groups in July.
Source: Ransomware.live, figures as of September 25, 2026. Leak sites keep posting victims late, so the August count can still rise a little.
What the month looked like
Qilin led the activity with 164 victims, around 16% of the total and up from 127 in July. The Gentlemen followed with 116, down from 135. Clop added 45, with Inc Ransom and Direwolf close behind at 43 each. Together, the five busiest groups accounted for 411 victims, just under 40% of everything recorded, with the remaining 645 spread across the other 78 groups.
By country, the United States took 366 attacks, about 35% of the month. Germany had 59, Italy 48, the United Kingdom 47 and France 27. These five countries together held more than half the total.
By sector, Manufacturing topped the list with 168 victims, meaning factories, workshops and other production businesses. Technology followed with 138, covering software firms, IT vendors and related services. Professional Services, which includes law firms, accountants and agencies, had 123. Healthcare, meaning hospitals, clinics and similar providers, had 113. A further 110 victims were filed under Not Found, which simply means the victim’s industry was not recorded in the source data.
What this means for a small business
The first thing worth noticing is the spread. With 83 active groups, no single name dominates the picture, and the other 78 groups together produced more victims than the top five. Qilin and The Gentlemen, the two names that show up most often, account for about a quarter of the month between them. For a small business, the practical read is that the threat is broad rather than focused. You are not defending against one gang, you are defending against a crowded market where many of the operators are interchangeable.
The direction is up. Attacks rose by about 13% from July, and sixteen more groups posted victims. One month is not a trend, but more groups means more operators working through the same kind of targets.
Geography offers little comfort either. The United States takes the biggest share by a long way, but 78 other countries were hit in August. The attackers follow opportunity, not maps, and remote access, email and cloud services mean your location rarely changes your exposure.
The sector list is more directly useful. Production businesses, IT and software vendors, professional firms and healthcare all hold two things ransomware crews want: data that is hard to replace, and pressure to pay quickly. A factory loses revenue by the hour, a clinic cannot wait to treat patients, a law firm cannot release a client’s confidential file. If your business sits in one of these shapes, this is not abstract risk, it is the kind of work you already do.
There is also a quieter second risk. Many of the businesses hit are the kind you rely on: your accountant, your IT support, the software vendor who holds your customer list. If one of them is locked down, you feel it even if your own systems are fine. You can search our ransomware tracker for the companies you depend on, and ask to be emailed if one of them appears on a leak site later.
One thing to check this month
Pull up the list of anyone outside your business who can sign in to your systems. That includes your IT provider, your accountant, your payroll service, the software vendor who integrates with your accounts, and any former contractor who still has a login. For each one, confirm two things: they still need access, and their sign-in requires more than a password, such as a code from a phone or an authenticator app. If you find an account that no longer needs to be there, remove it. If you find one that still needs to be there but only uses a password, ask for the second factor to be turned on. The whole exercise should take less than an hour, and it closes a door that stays open long after the work that needed it is done.
Data from Ransomware.live as of September 25, 2026 | Report generated with AI assistance and checked against the source data
Related
- Ransomware attack tracker: search a company and get alerts
- Ransomware groups ranked by victims
- Live ransomware statistics