Ransomware statistics 2026: confirmed attacks by month

Ransomnews has independently confirmed 9,291 ransomware attacks worldwide between January 2018 and July 2026. So far in 2026, 504 attacks have been confirmed, including 3 in July 2026. The dataset covers 149 countries, is verified by humans rather than scraped from leak sites, and every figure on this page is recalculated from the live database, refreshed weekly.

Data last updated: 8 July 2026

This page is the monthly statistics report for the Ransomnews Confirmed Ransomware Attacks Dataset. Unlike most ransomware statistics circulating online, which count unverified leak-site listings, every incident counted here has been independently confirmed through breach disclosures, regulatory filings, official statements, or credible press reporting. The tables below are generated directly from the live database, so they always reflect the current state of the dataset.

How many ransomware attacks are confirmed each year?

Confirmed ransomware attacks have run at roughly 1,400 to 1,550 per year since 2023, after a visible dip in 2022. The 2020 to 2021 surge, the 2022 trough (which coincided with the Conti shutdown and the Russia-Ukraine war reshuffling the ecosystem), and the post-2023 plateau are all visible in the yearly series. The current year always shows a partial count.

How many ransomware attacks were confirmed each month?

The monthly series below covers the trailing thirteen months. Read the most recent two to three months as provisional: confirmation lags the attack itself, sometimes by weeks, so recent months fill in as disclosures, filings and reporting catch up. A low figure for last month usually means confirmations are still arriving, not that attacks stopped.

Which ransomware groups have the most confirmed victims?

LockBit remains the all-time leader by confirmed victims, with more than 500 verified attacks attributed to the operation since 2019, ahead of Qilin, Akira and the now-defunct Conti. The first table shows the current year, which is where leadership changes show up first; the second shows the all-time ranking. Note that these are confirmed victims, so the numbers are lower, and more defensible, than the claim counts the groups themselves publish. Profiles of the major operators are in our threat group catalogue.

Which countries have the most confirmed ransomware attacks?

The United States accounts for roughly half of all confirmed ransomware attacks in the dataset, followed at a distance by France, Germany, Japan, Canada and the United Kingdom. Part of that gap is real exposure and part is reporting bias: US breach-notification and SEC disclosure rules force more incidents onto the public record than most jurisdictions, which makes American attacks easier to confirm.

Which industries does ransomware hit hardest?

Business is the largest umbrella category at around three fifths of confirmed attacks, but the standout concentrations are in the public-facing sectors: government, healthcare and education together account for well over a third of all confirmed incidents. These are the sectors where operational disruption is most visible, which drives both the targeting and the confirmation rate.

What are the most recent confirmed attacks?

The ten most recently confirmed incidents are listed below. For the live view, including unverified leak-site claims as they appear and the interactive map of all confirmed attacks, see the Ransomtracker.

Where these numbers come from

The dataset behind this page is compiled and verified by Ransomnews. An incident is counted only when it is confirmed by at least one independent source: a disclosure by the victim, a regulatory or court filing, an official statement, or credible press reporting. Leak-site listings alone do not qualify, because operators inflate, duplicate and occasionally fabricate claims. Each confirmed record carries the attack month, the victim organisation, city and country, industry and sub-industry classification, and the ransomware strain where attribution is solid. Ransom amounts and records-affected counts are recorded only where they are on the public record, which is the minority of cases.

Coverage runs from January 2018 to the present across 149 countries. The database refreshes weekly; this report page recalculates from it on every load, and we review the editorial commentary monthly.

How to cite these statistics

Cite as: Ransomnews Confirmed Ransomware Attacks Dataset, Ransomnews.com, with a link to this page or to the Ransomtracker. Journalists and researchers can request bulk access, methodology details, or comment at [email protected]. We answer quickly and we correct the record when someone shows us we are wrong.

Frequently asked questions

Sources & further reading

• Ransomtracker: the live tracker, with the interactive map and the full confirmed dataset behind this page
• Threat group profiles: editorial coverage of the major ransomware operations
• Double extortion explained: how the dominant ransomware playbook actually works
• CISA StopRansomware: US government guidance and advisories
• FBI IC3: official US cybercrime complaint statistics, a useful comparison series