Global Ransomware Attacks Rise in Q2 2026, Led by Qilin and The Gentlemen

Ransomware activity increased in the second quarter of 2026, with 1,885 distinct incidents reported—a rise over both the previous quarter and the same period in 2025. Manufacturing was the most targeted sector, accounting for about 20% of attacks, while the technology industry saw a growing share of incidents as threat actors seek to embarrass high‑profile firms.

GuidePoint Security identified a “four‑headed monster” of prolific groups—Qilin, The Gentlemen, Akira and DragonForce—responsible for more than 40% of all attacks. The United States accounted for 40% of victims, and Germany followed with 32%. While some groups are experimenting with AI tools to automate routine tasks, the feared emergence of AI‑native catastrophic attacks has not materialised.

Analysts linked the surge to heightened geopolitical tension between the United States and Iran, noting that nearly 45% of all incidents involved North American organisations. The shift away from retail targets toward technology firms reflects a desire for notoriety among ransomware groups.