September 2026 closed with 789 recorded ransomware attacks across 76 active groups in 91 countries, down from 1,055 attacks and 84 groups in August.
Source: Ransomware.live, figures as of October 1, 2026. Leak sites sometimes post victims late, so the September count can still change a little.
What the month looked like
The Gentlemen led the activity with 102 victims, about 13% of the total and down from 116 in August. Qilin followed with 74, less than half of its 162 in August, and that drop alone explains a third of the month’s decline. Storm added 37, Krybit 34 and SafePay 32. Together, the five busiest groups accounted for 279 victims, with the remaining 510 spread across the other 71 groups.
By country, the United States took 250 attacks, down from 366. Germany had 35, Canada 27, and Italy and Brazil 26 each. The total fell, but the map got wider: 91 countries were hit, against 79 in August.
By sector, Manufacturing topped the list again with 134 victims, meaning factories, workshops and other production businesses. Professional Services, which includes law firms, accountants and agencies, had 91. Technology, covering software firms, IT vendors and related services, had 90. Healthcare, meaning hospitals, clinics and similar providers, had 71. A further 91 victims were filed under Not Found, which simply means the victim’s industry was not recorded in the source data.
What this means for a small business
A quarter fewer attacks is good news, but it is not a reason to relax. A third of the drop came from one group, Qilin, and the United States alone had 116 fewer victims. The other 71 groups still produced 510 victims between them, more than the top five combined, and the attacks reached more countries than the month before. The market got a little quieter at the top, not smaller at the edges.
The sector list is where a small business should look. Professional Services and Technology were hit almost as often as each other, and together they outnumber Manufacturing, 181 to 134. A five-person accounting firm or a twenty-person law practice holds client tax records, payroll data and confidential contracts, and it cannot bill while those files are locked. You do not need to make physical products to hold data someone else can lock up for leverage.
The Technology figure matters even if you are not in technology. Few businesses of twenty people build their own tools: email, accounting, IT support and file storage come from outside vendors. When one of those vendors is locked down, you feel it even if your own systems are fine. You can search our ransomware tracker for the companies you depend on, and ask to be emailed if one of them appears on a leak site later.
One thing to check this month
Take forty minutes to compare the user accounts in your email system, such as Microsoft 365 or Google Workspace, against your current payroll and your list of active vendors. Sign in as an administrator, open the user list and look for three things:
- Former staff whose accounts were never closed.
- Bookkeepers, contractors or vendors who no longer work with you.
- Shared mailboxes or generic logins, such as info@ or sales@, that sign in with only a password.
Block sign-in for any account that belongs to someone who has left, and remove its license. For shared mailboxes you still need, turn on a second sign-in step or remove direct sign-in altogether. Forgotten accounts keep their access and nobody watches them, which makes them one of the simplest ways in, and closing them costs nothing.
Data from Ransomware.live as of October 1, 2026 | Report generated with AI assistance and checked against the source data
Related
- Ransomware attack tracker: search a company and get alerts
- Ransomware groups ranked by victims
- August 2026 Ransomware Report