A record quarter, by a wide margin
Comparitech's Q3 2026 ransomware data, covering July through September, counted 2,627 claimed attacks, the highest quarterly total the firm has tracked. That is a 27% jump from Q2 2026 and a 61% jump from the same quarter a year earlier. Of those claims, 247 have been confirmed directly by victims, which is the usual gap between what ransomware groups announce on leak sites for leverage and what organizations have actually acknowledged happened to them.
Rebecca Moody, head of data research at Comparitech, frames this quarter as a break from the normal pattern rather than an ordinary fluctuation: 'Q3 2026 is different.' The reason that framing matters is that ransomware trend lines usually move in the kind of noisy, incremental steps that make any single quarter easy to dismiss. A 61% year-over-year jump across a quarter this large does not fit that pattern, and treating it as routine variance is the mistake boards and budget committees are most likely to make heading into next year's planning cycle.
Finance and technology absorbed the steepest increases
Sector breakdowns show finance attacks up 72% and technology attacks up 70% quarter over quarter, the two steepest increases among all tracked sectors. Education rose 50%, healthcare 39%, government 36%, and utilities 32%. For an audience running PE-backed SaaS and commerce businesses, the technology sector number is the one that should not be filed under someone else's problem. A 70% jump in a single quarter means the sector you operate in absorbed a meaningfully larger share of total ransomware activity than it did three months earlier, independent of whether your specific company was targeted.
Geographically, the United States accounted for 1,066 attacks, about 41% of the global total, up 34% from the prior quarter. Germany followed with 121 attacks, up 22%. The sharpest relative jumps came from Argentina, up 150%, and India, up 116%, which suggests ransomware operators are actively expanding their targeting beyond the historically dominant US and European markets rather than simply intensifying pressure on existing ones. For multinational operators, that expansion matters even if your headquarters sits in a market that looks comparatively stable this quarter, because a regional subsidiary, supplier, or data center in one of these faster-growing markets now carries meaningfully more exposure than it did two quarters ago, and your risk model should reflect that shift rather than lag behind it.
The groups driving the surge are not the usual names at the top
Qilin led with 357 claimed attacks, up 24%, and The Gentlemen followed with 342, up 29%. Those are large, familiar operators scaling incrementally. The more striking numbers belong to groups moving from near-zero to significant volume within a single quarter. Clop went from one claimed attack in Q2 to 48 in Q3, a 4,700% increase. Direwolf rose 1,450%. Growth at that scale in a single quarter typically signals that a group has found a specific vulnerability class, access broker relationship, or affiliate recruitment pipeline that works, and is running it as hard as possible before defenders catch up.
That pattern has a direct implication for patch prioritization. A group making a sudden, order-of-magnitude jump in claimed attacks is very likely exploiting something specific and repeatable, not simply getting lucky more often. Security teams tracking threat intelligence feeds should treat a group's sudden volume spike as a signal to check which vulnerability or access vector that group has been publicly linked to recently, since that is usually the fastest way to identify what just became newly exploitable at scale.
Paying does not buy what victims think it buys
The ransom figures tell their own story. The average demand reached $602,400, with the two highest known demands both ending badly for the victim regardless of their choice. Everest demanded $12.3 million from Stadler Rail in July; Stadler refused, and Everest leaked 201 GB of data. Rhysida demanded $2.3 million from the State of Berlin; the state refused, and Rhysida published 5.7 TB of data. Both cases show refusal does not prevent the leak, which undercuts the simplest argument for paying: that payment at least avoids the exposure.
Moody's sharper point is that a completed payment still leaves the leak risk standing. She cites MIP Holdings, which paid The Gentlemen to have its data deleted, only to have the group later add MIP's own clients to its leak site anyway, a tactic researchers are calling triple extortion: pressuring individuals whose data the breached organization held, layered on top of pressuring the organization itself. For any executive weighing a ransom payment as a way to make the problem go away, this quarter's data says that outcome holds only sometimes, even when the group accepts the payment in apparent good faith.
What this means for budget and board conversations
If your sector showed up in the top tier of this quarter's increases, finance, technology, education, healthcare, government, or utilities, that is not a statistic to note and move past. It is a budget conversation to have before the next board cycle, specifically around whether your incident response retainer, backup immutability, and detection coverage were sized for last year's threat volume rather than this year's. A 61% year-over-year increase in claimed attacks is the kind of number that should move a line item, not just a slide in a quarterly risk report.
Researchers flag AI as a plausible contributor to this surge, helping attackers scale reconnaissance and campaign execution faster than before, which tracks with the broader pattern of agentic and AI-assisted tooling showing up on the offensive side across multiple incidents this year. Whatever the precise cause, the practical response is the same: treat your ransomware readiness plan as a living document that gets pressure-tested against the current quarter's data, not a binder reviewed once a year on a fixed schedule that was set when the threat landscape looked meaningfully smaller than it does now.
