Ransomnews has independently confirmed 9,711 ransomware attacks worldwide between January 2018 and October 2026. So far in 2026, 872 attacks have been confirmed, including 5 in October 2026. The dataset covers 153 countries, is verified by humans rather than scraped from leak sites, and every figure on this page is recalculated from the live database, refreshed weekly.
Data last updated: 7 October 2026
By the Ransomnews Research Team. Every table on this page recalculates from the live database on each load.
This page is the monthly statistics report for the Ransomnews Confirmed Ransomware Attacks Dataset. Unlike most ransomware statistics circulating online, which count unverified leak-site listings, every incident counted here has been independently confirmed through breach disclosures, regulatory filings, official statements, or credible press reporting. The tables below are generated directly from the live database, so they always reflect the current state of the dataset.
How many ransomware attacks are confirmed each year?
Confirmed ransomware attacks have run at roughly 1,400 to 1,550 per year since 2023, after a visible dip in 2022. The 2020 to 2021 surge, the 2022 trough (which coincided with the Conti shutdown and the Russia-Ukraine war reshuffling the ecosystem), and the post-2023 plateau are all visible in the yearly series. The current year always shows a partial count.
| Year | Confirmed attacks |
|---|---|
| 2018 | 168 |
| 2019 | 458 |
| 2020 | 1,228 |
| 2021 | 1,436 |
| 2022 | 959 |
| 2023 | 1,551 |
| 2024 | 1,550 |
| 2025 | 1,489 |
| 2026 (year to date) | 872 |
How many ransomware attacks were confirmed each month?
The monthly series below covers the trailing thirteen months. Read the most recent two to three months as provisional: confirmation lags the attack itself, sometimes by weeks, so recent months fill in as disclosures, filings and reporting catch up. A low figure for last month usually means confirmations are still arriving, not that attacks stopped.
| Month | Confirmed attacks |
|---|---|
| October 2025 | 120 |
| November 2025 | 115 |
| December 2025 | 123 |
| January 2026 | 100 |
| February 2026 | 98 |
| March 2026 | 128 |
| April 2026 | 103 |
| May 2026 | 87 |
| June 2026 | 101 |
| July 2026 | 84 |
| August 2026 | 109 |
| September 2026 | 57 |
| October 2026 | 5 |
Which ransomware groups have the most confirmed victims?
LockBit remains the all-time leader by confirmed victims, with more than 500 verified attacks attributed to the operation since 2019, ahead of Qilin, Akira and the now-defunct Conti. The first table shows the current year, which is where leadership changes show up first; the second shows the all-time ranking. Note that these are confirmed victims, so the numbers are lower, and more defensible, than the claim counts the groups themselves publish. Profiles of the major operators are in our threat group catalogue.
| # | Ransomware group | Confirmed victims, 2026 |
|---|---|---|
| 1 | Qilin | 92 |
| 2 | The Gentlemen | 87 |
| 3 | INC | 50 |
| 4 | Akira | 42 |
| 5 | LockBit | 35 |
| 6 | SafePay | 28 |
| 7 | DragonForce | 23 |
| 8 | Chaos | 20 |
| 9 | Interlock | 17 |
| 10 | Kairos | 14 |
| # | Ransomware group | Confirmed victims, all time |
|---|---|---|
| 1 | LockBit | 545 |
| 2 | Qilin | 346 |
| 3 | Akira | 311 |
| 4 | Conti | 269 |
| 5 | Play | 223 |
| 6 | INC | 217 |
| 7 | ALPHV/BlackCat | 217 |
| 8 | Black Basta | 174 |
| 9 | Maze | 170 |
| 10 | RansomHub | 166 |
Which countries have the most confirmed ransomware attacks?
The United States accounts for roughly half of all confirmed ransomware attacks in the dataset, followed at a distance by France, Germany, Japan, Canada and the United Kingdom. Part of that gap is real exposure and part is reporting bias: US breach-notification and SEC disclosure rules force more incidents onto the public record than most jurisdictions, which makes American attacks easier to confirm.
| # | Country | Confirmed, 2026 |
|---|---|---|
| 1 | United States | 318 |
| 2 | Japan | 88 |
| 3 | Germany | 61 |
| 4 | Australia | 43 |
| 5 | Turkey | 22 |
| 6 | Spain | 21 |
| 7 | Italy | 21 |
| 8 | South Africa | 20 |
| 9 | Switzerland | 19 |
| 10 | France | 19 |
| # | Country | Confirmed, all time |
|---|---|---|
| 1 | United States | 5,194 |
| 2 | France | 505 |
| 3 | Germany | 416 |
| 4 | Japan | 378 |
| 5 | Canada | 356 |
| 6 | United Kingdom | 321 |
| 7 | Australia | 234 |
| 8 | Italy | 219 |
| 9 | Brazil | 157 |
| 10 | Spain | 148 |
Which industries does ransomware hit hardest?
Business is the largest umbrella category at around three fifths of confirmed attacks, but the standout concentrations are in the public-facing sectors: government, healthcare and education together account for well over a third of all confirmed incidents. These are the sectors where operational disruption is most visible, which drives both the targeting and the confirmation rate.
| Industry | Confirmed attacks | Share |
|---|---|---|
| Business | 5,888 | 60.6% |
| Government | 1,519 | 15.6% |
| Healthcare | 1,352 | 13.9% |
| Education | 952 | 9.8% |
| Sub-industry | Confirmed attacks |
|---|---|
| Healthcare | 1,674 |
| Government | 1,519 |
| Manufacturing | 1,070 |
| Education | 1,004 |
| Service | 689 |
| Other | 665 |
| Finance | 643 |
| Technology | 573 |
What are the most recent confirmed attacks?
The ten most recently confirmed incidents are listed below. For the live view, including unverified leak-site claims as they appear and the interactive map of all confirmed attacks, see the Ransomtracker.
| Date | Organisation | Country | Sector | Strain |
|---|---|---|---|---|
| October 2026 | Andersen Group Inc. | United States | Business / Finance | LeakedData/Silent Ransom Group |
| October 2026 | University of Illinois Chicago | United States | Education | Booba Project |
| October 2026 | Colegio Oficial de Arquitectos de León | Spain | Business / Other | Akira |
| October 2026 | Osaka Metropolitan University | Japan | Education | Unknown |
| October 2026 | City of Vicksburg | United States | Government | Unknown |
| September 2026 | Lakewood Medical Centre | Canada | Healthcare | Booba Project |
| September 2026 | The Japan Times | Japan | Business / Other | Eclipse |
| September 2026 | Ada Mert Sağlık Hizmetleri Ticaret AŞ | Turkey | Healthcare | Unknown |
| September 2026 | CR Healthcare Services | India | Business / Healthcare | Unknown |
| September 2026 | Ikegami Tsushinki Co., Ltd. | Japan | Business / Manufacturing | Qilin |
Where these numbers come from
The dataset behind this page is compiled and verified by Ransomnews. An incident is counted only when it is confirmed by at least one independent source: a disclosure by the victim, a regulatory or court filing, an official statement, or credible press reporting. Leak-site listings alone do not qualify, because operators inflate, duplicate and occasionally fabricate claims. Each confirmed record carries the attack month, the victim organisation, city and country, industry and sub-industry classification, and the ransomware strain where attribution is solid. Ransom amounts and records-affected counts are recorded only where they are on the public record, which is the minority of cases.
Coverage runs from January 2018 to the present across 149 countries. The database refreshes weekly; this report page recalculates from it on every load, and we review the editorial commentary monthly.
How to cite these statistics
Cite as: Ransomnews Confirmed Ransomware Attacks Dataset, Ransomnews.com, with a link to this page or to the Ransomtracker. Journalists and researchers can request bulk access, methodology details, or comment at [email protected]. We answer quickly and we correct the record when someone shows us we are wrong.
Frequently asked questions
How many ransomware attacks happen per year?
Independent verification puts the floor at roughly 1,400 to 1,550 confirmed ransomware attacks per year worldwide since 2023, based on the Ransomnews Confirmed Ransomware Attacks Dataset. The true total is higher, because many victims never disclose and many incidents are never independently verified, so confirmed counts should be read as a defensible minimum rather than the full picture.
How many ransomware attacks have there been in 2026?
The opening paragraph of this page shows the live 2026 count, recalculated from the database on every load. For orientation, more than 500 attacks had been confirmed by early July 2026, and the most recent months always fill in further as disclosures, filings and reporting catch up with the attacks themselves.
Which country has the most ransomware attacks?
The United States, by a wide margin: it accounts for roughly half of all ransomware attacks confirmed worldwide since 2018, with more than 5,000 verified incidents. France, Germany, Japan, Canada and the United Kingdom form the next tier, each in the hundreds. Strong US breach-notification and SEC disclosure rules also make American incidents easier to confirm, which inflates the US share somewhat.
What is the most active ransomware group right now?
By confirmed victims across the whole dataset, LockBit leads with more than 500 verified attacks since 2019. Leadership rotates as groups are disrupted and rebrand, and the current-year table on this page shows who leads right now; in 2026 the front of the field has been contested by Qilin, The Gentlemen and INC.
Are ransomware leak-site victim counts accurate?
Not on their own. Leak-site tallies measure what criminal operators claim, and those claims include duplicates, recycled data and outright fabrications, while some real attacks never appear on any leak site. This page counts only incidents verified through independent sources, which is why its totals sit below raw leak-site numbers and why the two should never be compared directly.
Do ransomware victims say whether they paid the ransom?
Rarely. Around nine in ten confirmed attacks in this dataset have no ransom figure on the public record, and most victims never state whether they paid at all. Any statistic about average ransom payments is therefore built on a small, self-selected sample and should be treated with caution. Our ransomware payment rate analysis tracks the disclosed rate year by year, by sector, country and group, and explains the biases in it.
Can I cite or republish these statistics?
Yes. Cite the figures as the Ransomnews Confirmed Ransomware Attacks Dataset, with a link to this page, which is the canonical and continuously updated source. Charts carry the ransomnews.com mark and may be reused with attribution; for bulk data access or methodology questions, contact [email protected].
Sources & further reading
- Ransomtracker: the live tracker, with the interactive map and the full confirmed dataset behind this page
- Confirmed ransomware attacks by sector, country and year: one page per sector, country and year, with groups, largest incidents, payment outcomes and the latest confirmed cases
- Ransomware payment rate, 2018 to 2026: how the disclosed payment rate has fallen, and why it differs from Coveware’s
- Threat group profiles: editorial coverage of the major ransomware operations
- Double extortion explained: how the dominant ransomware playbook actually works
- Breach verification desk: how we test whether a leaked dataset is real, old, scraped or fabricated before we report it
- CISA StopRansomware: US government guidance and advisories
- FBI IC3: official US cybercrime complaint statistics, a useful comparison series