Global ransomware attack trends and evolution

Ransomware attacks reached record levels in the third quarter of 2026, with 2,627 total incidents reported. All four key sectors saw significant increases, led by a 50 percent rise in the education sector. The United States was the most targeted region, accounting for 41 percent of all attacks, while India and Argentina experienced substantial growth in incident rates.

Research indicates that attackers are rapidly exploiting high-severity vulnerabilities, often within three days of public disclosure. Approximately 79 percent of exploited high- and critical-severity vulnerabilities required no authentication or user interaction.

The threat landscape is further evolving through the use of post-quantum cryptography (PQC). The Kyber ransomware group has been identified as the first to deploy NIST-standardized PQC in active attacks, specifically targeting an American defense contractor.

Additionally, the healthcare sector has seen a surge in activity, with 317 ransomware events recorded in the third quarter, representing 9.72 percent of all critical infrastructure ransomware events. Groups such as ShinyHunters are also shifting tactics toward identity and SaaS-access extortion, using domain impersonation and voice phishing to steal credentials rather than traditional file encryption.