The Ransomware Brief –
Aug 2026
From January to June, ransomware volume stayed in a narrow band of 536 to 699 attacks a month and slowly declined. It looked like the market was settling. Then July jumped 60% and August added another 25%, a 101% rise in just two months.
For security teams, this matters for planning. If your 2026 budget, staffing, or risk models were built on first-half numbers, they are now about 41% below what attackers are actually doing.
The Ransomware Landscape for August 2026 at a Glance
Recorded attacks
Publicly claimed victims
Active ransomware gangs
Victims claimed by Qilin
Victims each in Manufacturing and Professional Services
Of global victims were in the U.S.
Attackers are increasingly moving beyond traditional encryption.
Data theft. AI-assisted operations. Automated victim profiling. EDR-killing frameworks.
The CL0P campaign exploiting CVE-2026-12569 compromised 40+ organizations through silent data exfiltration—without encrypting files.
Download ReportGet a data-driven view of:
Who it's for
- CISOs and security leaders who need a board-ready view of this month's ransomware risk.
- Threat intelligence and SOC teams tracking the gangs, techniques, and vulnerabilities in active use.
- Regional and multinational security teams who need to know which gangs are working in their markets, not just the global headliners.