March 2026 Ransomware Surge: Critical Infrastructure Under Fire March 2026 marked a sharp escalation in ransomware activity, with 780 attacks recorded a 13% increase from February and the second-highest monthly total since February 2025. The surge was driven by targeted campaigns against critical sectors, with state-sponsored and financially motivated threat actors prioritizing high-impact disruptions. ### Key Trends & Sector Impacts - Utilities Under Siege: The utility sector saw a staggering 630% spike, with 22 attacks in March (up from just 3 in February). Sixteen countries were targeted, including six U.S. utility companies, as attackers sought to maximize operational chaos. - Manufacturing & Government Hit Hard: Attacks on manufacturers rose 36%, while government entities faced a 30% increase, reflecting a broader shift toward high-value, high-disruption targets. - Healthcare & Education: Healthcare attacks declined 15%, though six incidents were confirmed across six countries, including Germany, the U.S., and Japan. The education sector remained stable, with 18 attacks (up from 17 in February), including a four-day shutdown at a UK school. ### Ransomware Gangs & Data Theft - Top Threat Actors: Qilin (140 attacks), Akira (80), and The Gentlemen (68) led the month, with Qilin and The Gentlemen also responsible for the most confirmed breaches (7 and 5, respectively). - Massive Data Exfiltration: Over 242 TB of data was stolen, with PEAR’s attack on Monmouth University alone exposing 16 TB. A new group, AiLock, claimed the largest single haul (43 TB), including 129 GB from England Hockey. ### Geographic Hotspots - U.S. Remains Prime Target: The U.S. accounted for 375 attacks (48% of the total), followed by France (32), and Germany, the UK, and Canada (26 each). - Europe’s Rising Threat: France saw a 113% surge, while the UK (+86%) and Germany (+73%) also experienced sharp increases. In contrast, attacks declined in Canada (-21%), India (-40%), and Brazil (-42%). ### Confirmed vs. Unconfirmed Attacks - 55 attacks were confirmed in March, with businesses (33), government (10), healthcare (6), and education (6) making up the bulk. - Unconfirmed attacks (725) followed a similar distribution, though businesses bore the brunt (654 incidents). Many organizations remain silent, either due to non-disclosure policies or delayed breach reporting laws. ### Notable Incidents - Critical Infrastructure: The City of Minot’s (U.S.) water treatment plant was breached, though operations remained unaffected. In Germany, Fernheizwerk Neukölln AG (a heating plant) suffered disruptions to accounting and communications. - Government & Healthcare: Paraguay’s IPS (2 TB stolen), Namibia’s airports, and Spain’s Puerto de Vigo were among confirmed government breaches. In healthcare, Aroostook Mental Health Services (U.S.) refused to pay a ransom, while Japan’s Shiraume Toyooka Hospital was hit by NetRunnerPR. - Manufacturing Disruptions: AkzoNobel (U.S.), LISI Group (France), and OMAX Autos (India) were among the 12 confirmed manufacturing victims, with some facing shipping delays and operational halts. The March 2026 surge underscores a strategic shift toward critical infrastructure and high-value sectors, with ransomware gangs leveraging data theft, operational disruption, and public exposure as primary tactics. As confirmation lags continue, the true scale of the month’s attacks may grow in the coming weeks.

The Maine Office of the Attorney General disclosed that Hydromax USA suffered a data breach between April 19–24, 2022, when an unauthorized actor infiltrated its network and exfiltrated files. The incident potentially compromised the personal information of 255 individuals, including at least one Maine resident. While the exact type of data exposed was not detailed, the breach prompted the company to issue written notifications to affected parties on June 15, 2022, alongside offering one year of identity theft protection services via Kroll as a remedial measure. The breach highlights vulnerabilities in Hydromax USA’s cybersecurity defenses, raising concerns over unauthorized access to sensitive data, though no immediate financial fraud or large-scale exploitation was reported in the aftermath.