Summary Points
-
Ransomware victim postings surged: 2,889 publicly disclosed victims were recorded in Q3 2026—up 80% year over year and about 30% from Q2—across 111 active groups.
-
The ecosystem is fragmenting: Qilin led with 362 victims, narrowly ahead of Thegentlemen at 360; the top 10 groups accounted for 48% of postings, while 47 groups each listed fewer than 10 victims.
-
Manufacturing was the leading target: It represented 16.4% of victims, with attacks spanning 121 countries and 13 sectors. The U.S. accounted for 34.7% of listed victims.
- Activity peaked in August, then eased: Monthly postings rose from 970 in July to 1,064 in August before falling to 855 in September. These leak-site figures reflect publicly disclosed victims—not the full number of ransomware incidents.
Underlying Problem
Bridewell’s threat intelligence team reports that publicly disclosed ransomware victims rose 80% year over year in the third quarter of 2026, reaching 2,889 across 111 active groups. The figures, drawn from Ransomware.live, count organizations posted on data-leak sites—not every ransomware incident. Qilin led with 362 claimed victims, followed closely by Thegentlemen with 360. However, the top 10 groups accounted for a smaller share of postings than in the prior quarter, suggesting that activity was spreading across a more fragmented field. August recorded the highest monthly total, at 1,064, before postings eased in September.
The attacks affected organizations in 121 countries and 13 sectors. The United States had the most publicly listed victims, while manufacturing was the hardest-hit industry, with 474 postings. Bridewell says manufacturing and other data-rich, operationally dependent sectors may be especially attractive because disruptions can create urgent pressure to restore systems. New groups, including Storm and Direwolf, also appeared as established operators gained momentum. Still, the report cautions that leak-site figures offer only a partial view: some victims are never publicly listed. Bridewell assesses, with moderate confidence, that elevated activity may continue into the fourth quarter.
Security Implications
The reported 80% surge is a warning that ransomware can reach any business—not only manufacturers. Attackers may exploit a stolen password, vulnerable software, or a trusted supplier to lock essential systems or steal sensitive data. Consequently, staff may lose access to files, orders, payment systems, or production tools, bringing work to a halt. Meanwhile, the business may face recovery costs, lost revenue, legal obligations, and pressure from customers or regulators. Even after systems return, trust can erode and operations may remain disrupted. In short, one intrusion can spread from a technical problem into a financial, operational, and reputational crisis.
Possible Action Plan
The reported 80% surge makes rapid remediation essential: every delay can widen an intrusion, halt production, and undermine recovery.
Priority Actions
- Govern exposure: Assign accountable owners for ransomware risk; set remediation deadlines based on operational impact, exploitability, and safety consequences.
- Map critical assets: Maintain current inventories of IT, operational technology (OT), industrial control systems, remote-access paths, and dependencies. Identify which systems must remain available for safe operations.
- Close high-risk gaps: Patch exploited and internet-facing vulnerabilities promptly. Where patching could disrupt OT or cannot be done safely, restrict access, disable unnecessary services, or apply vendor-approved compensating controls.
- Harden access: Require phishing-resistant multifactor authentication for remote and privileged access; remove stale accounts, rotate exposed credentials, and limit privileges to what each role requires.
- Contain pathways: Segment IT from OT and separate production zones from one another. Restrict administrative tools and remote connections; monitor and tightly control vendor access.
- Detect early: Centralize and review endpoint, identity, network, and OT security alerts. Investigate unusual encryption, privilege escalation, remote logins, and transfers of large data volumes.
- Respond safely: Use a practiced incident-response plan to isolate affected systems, disable compromised accounts, preserve evidence, and coordinate with leadership, legal counsel, insurers, vendors, and relevant authorities. Avoid actions that could endanger plant operations.
- Restore with confidence: Keep offline or immutable backups of critical systems and configurations. Test restoration regularly, verify backups are clean, and bring systems back in stages while monitoring for reinfection.
- Learn and improve: After recovery, identify the initial access route, remove persistence, close control gaps, and update response procedures and workforce training in line with NIST CSF outcomes.
Continue Your Cyber Journey
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
