Nearly 3,000 ransomware attacks occurred between July and September 2026, marking a sharp rise in malicious activity compared with the same timeframe last year. According to an analysis by Nord Security, published on October 21, the 2,894 ransomware incidents during the quarter represent a 50% jump year-over-year. The report suggests that law enforcement takedowns against major ransomware operations in 2025 temporarily disrupted the market, but criminal groups are now regaining momentum in what researchers call "ransomware's new era."
The third quarter of 2026 also saw an 8.6% increase in ransomware attacks compared with the April-to-June period this year. Two ransomware gangs dominated the threat landscape during the reporting period: The Gentlemen and Qilin. The Gentlemen carried out 383 ransomware attacks, while Qilin was close behind with 363 recorded incidents. The third most active group, Inc Ransom, accounted for 110 attacks. Other groups showing substantial activity during the quarter included Krybit, Akira, Deadlock, and Clop Leaks, each with nearly 100 ransomware attacks. The two leading threat groups have swapped positions as the most common perpetrator of ransomware attacks throughout 2026.
A rivalry between The Gentlemen and Qilin is driving both groups to develop fresh attack methods for claiming additional victims, the report finds. Mantas Sabeckis, senior threat intelligence researcher at Nord Security, explained that The Gentlemen's founder previously led one of Qilin's top affiliate crews before a financial dispute over an unpaid cut. "His answer was to start a new group and lure his former colleagues away with a 90% payout, well above the usual 70% to 80%," Sabeckis said. "This quarter, the breakaway The Gentlemen group edged past Qilin by 20 attacks." Both groups have begun removing the encryption element from their ransomware operations, instead simply stealing sensitive information from victims and threatening to publish it unless they receive payment. According to Sabeckis, stealing data is faster and simpler, allowing one group to target many victims simultaneously with far less effort—a shift that's likely contributing to climbing attack volumes.
The report attributes the significant rise in ransomware activity to market stabilization following law enforcement takedowns of groups like Lockbit, BlackCat, and RansomHub, which helped reduce ransomware incidents during 2025. Vakaris Noreika, VP of product research and development at Nord Security, described current attack numbers as "merely the first stepping stone in ransomware's new era." Despite the evolution in attack tactics, researchers noted that initial entry points for attacks have remained broadly consistent: compromised passwords, lack of multi-factor authentication on accounts, and unpatched security vulnerabilities. "The names on the most prolific ransomware group list regularly change, but the way they get in doesn't," Noreika said. "What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk." While encryption may be disappearing from some operations, Sabeckis noted that it isn't going away entirely, suggesting the threat landscape will continue to feature both data theft and traditional encryption-based attacks. The competitive dynamic between rival gangs appears poised to sustain elevated attack volumes as groups vie for dominance in a reorganized criminal marketplace. Organizations face a dual challenge: the technical defenses that worked against earlier ransomware generations remain necessary, but the shift toward pure data theft demands rethinking what constitutes a successful breach and how to measure exposure before encryption ever occurs.