Ransomware attacks reached an all-time quarterly high in the third quarter of 2026, according to an analysis published by Comparitech on October 7. The security research firm tracked 2,627 claimed attacks between July and September 2026, marking a sharp escalation in cybercriminal activity. The surge represents both a 27% jump from the second quarter of this year and a 61% climb compared to the same period in 2025.
The finance and technology industries saw the steepest rise in ransomware incidents during Q3 compared to Q2 2026, climbing 72% and 70% respectively. Education institutions faced a 50% increase in attacks, while healthcare organizations experienced a 39% rise. Government agencies saw attacks grow by 36%, and utilities by 32%. Of the 2,627 attacks claimed by ransomware groups during the quarter, 247 were confirmed by the targeted organizations. The United States absorbed 1,066 of the attacks—representing 41% of the global total—a 34% increase from the prior quarter. Germany recorded 121 attacks, up 22%, while Argentina and India experienced the sharpest proportional spikes at 150% and 116% respectively.
Rebecca Moody, head of data research at Comparitech, characterized the third-quarter figures as highly unusual and a significant cause for concern. "We're not seeing slight increases or decreases. We're seeing significant increases across all key sectors," she noted. The report identified a growing trend toward triple extortion tactics, in which attackers encrypt systems, steal data, and then target individuals affected by the breach. Moody cited The Gentlemen's attack on South African tech company MIP Holdings as an example: after MIP paid a ransom in June 2026, the group began adding MIP's clients to its data leak site in recent weeks to extract additional payments. The average ransom demand during Q3 stood at $602,400, while the highest known demand reached $12.3 million—issued by Everest against Swiss railway manufacturer Stadler Rail in July 2026. After Stadler refused to pay, Everest released 201 GB of stolen data.
The report points to advances in artificial intelligence technology as a possible driver behind the surge, noting that AI is enabling ransomware operators to scale and accelerate their campaigns while improving their effectiveness. In July, researchers identified the JadePuffer campaign, believed to be the world's first ransomware attack entirely powered by AI. The shift toward triple extortion further underscores a key risk for victim organizations: paying a ransom offers no guarantee that attackers will delete stolen data or refrain from further targeting, according to Moody. Qilin and The Gentlemen emerged as the most active ransomware groups during the quarter, claiming 357 and 342 attacks respectively—representing a 24% increase for Qilin and a 29% rise for The Gentlemen compared to Q2. Clop saw its attack volume explode by 4,700%, jumping from a single attack in Q2 to 48 in Q3, while Direwolf's claimed attacks surged by 1,450% over the same period.
The escalating frequency and sophistication of ransomware attacks across all critical sectors signals that organizations can no longer treat cybersecurity as a secondary concern, particularly as threat actors refine extortion methods that weaponize both corporate and individual data. For business leaders, the central lesson isn't just about hardening defenses—it's recognizing that ransom payments have become a catalyst for further exploitation rather than a resolution.