Ransomware attacks reach record numbers amid cloud security risks

Ransomware attacks reached record levels between April 2025 and March 2026, according to the 2026 Ransomware Report by Black Kite. The report identified 7,551 publicly disclosed victims, marking a 24.9% increase from the previous period. The frequency of attacks accelerated significantly in the latter half of the analyzed period, with March 2026 recording a monthly high of 861 victims.

In cloud environments, ransomware presents unique challenges by shifting the attack surface. Criminal groups exploit compromised administrative credentials, identity vulnerabilities, and exposed integrations to cause service unavailability. While cloud providers protect physical infrastructure, organizations remain responsible for configurations, identities, permissions, and data protection under the shared responsibility model.

Modern ransomware operations have become increasingly professionalized, often employing double or triple extortion tactics. Beyond encrypting servers, attackers seek to exfiltrate data, delete snapshots, and alter retention policies to maximize pressure on organizations.