Ransomware Attacks Surge to Record High in August 2026 August 2026 marked a historic spike in ransomware activity, with 997 attacks recorded a 23% increase from July’s 809 and surpassing the previous record of 988 set in February 2025. The average daily attack rate rose to 32 incidents, up from 26 in July. ### Key Trends by Sector - Utilities saw the sharpest rise, with attacks doubling from five in July to 10 in August. - Healthcare experienced a 30% increase, while law firms (+52%), tech companies (+42%), and finance (+40%) also faced significant spikes. - Education (-4%) and food & beverage (-5%) were the only sectors to see declines. ### Dominant Ransomware Groups Qilin (157 attacks) and The Gentlemen (107 attacks) accounted for over 26% of all incidents, with Qilin surpassing its rival for the first time in months. Clop saw the largest relative increase, jumping from one attack in July to 45 in August, driven by exploits targeting the PTC Windchill vulnerability. ### Geographical Impact The U.S. remained the hardest-hit country (417 attacks), followed by Germany and Italy (48 each), the UK (36), and Canada (35). Italy and Taiwan saw the most dramatic surges, with attacks rising 200% in both nations. ### Confirmed vs. Unconfirmed Attacks Of the 997 total attacks, 77 were confirmed by affected organizations, while 920 remained unconfirmed. Among confirmed cases: - 49 targeted businesses, 18 government entities, 8 healthcare providers, and 2 educational institutions. - Qilin led confirmed attacks (12), followed by The Gentlemen (8). ### Notable Incidents - Healthcare: Nutex Health (U.S.), Cedar County Memorial Hospital (U.S.), and Windrose Health Network (U.S.) were among confirmed victims, with The Gentlemen, Wallstreet, and Storm claiming responsibility. Rhysida demanded 6 bitcoin ($376K) from Australia’s SIA Medical Centre, while Guatemala’s INCAN refused KRYBIT’s ransom. - Government: The U.S. ATF was hit by Qilin, while Berlin’s government rejected a 30 bitcoin ($2.3M) demand from Rhysida for 5.79TB of stolen data. Spain and Germany each reported two confirmed attacks. - Businesses: Alto Calore Servizi (Italy), a utility company, suffered its second major ransomware attack in three years. TechVentures Bank (Romania), Sawyer Savings Bank (U.S.), and Cartrack (South Africa) were among confirmed finance and tech sector victims. ### Year-to-Date Trends From January to August 2026, ransomware attacks rose 32% year-over-year, with 5,260 incidents recorded compared to 4,000 in 2025. Healthcare saw a 32% increase, while government attacks remained stable. Education experienced a 12% decline.