Ransomware victims hit 1,073 in August, the year's high; most don't pay

011,073 in August: the second record month in a row

NCC Group counted 2,165 ransomware attacks in the first quarter of 2026 and 2,229 in the second, a rise of 3%.² That is a flat year: about 720 to 740 a month. Then the summer broke the pattern. NCC’s August report puts July at 973 and August at 1,073, 12% higher, and its head of cyber intelligence, Matt Hull, called August “the second consecutive month of highest ransomware levels for the year.”¹ He put it down to “rapid advancements in AI and ongoing geopolitical volatility”; NCC gives no measurement behind that attribution, so we treat it as the firm’s view.

Two cautions before reading too much into it. August is a 2026 high, not an all-time one: NCC’s record month is still February 2025, at 1,099.³ And the latest month is a floor, not a final count. When NCC first reported July, in late August, it gave 894 attacks;³ a month later the same July stood at 973.¹ That is 79 more victims, 9%, added a month after the fact (our arithmetic). A victim that is never named publicly never enters a count like this at all.

02Who: one veteran, one newcomer and a long tail of brands

Five groups accounted for 455 of August’s 1,073 victims. Qilin led with 164; by NCC’s count it had been the most active group for five consecutive quarters to June.¹² The one to watch is second. The Gentlemen, a ransomware-as-a-service operation that GuidePoint says emerged in August 2025, went from 35 victims in the last quarter of 2025 to 182 in the first of 2026,⁴ 238 in the second by NCC’s count,² and 116 in August alone.¹ A year from launch to the top two.

Below the top five, the names churn. NCC flagged a new group, CRPxO, claiming 36 victims in July, and warned that its evidence was inconsistent and that new groups often exaggerate.³ Another newcomer, KryBit, entered NCC’s top ten in the second quarter.² And the league table depends on who is counting. Coveware, which negotiates for victims, saw a different top five in its second-quarter cases: Lone Wolf 17%, ShinyHunters 12%, Akira 9%, The Gentlemen 8% and DragonForce 4%.⁶ In Cowbell’s insurance claims, Akira was behind 38.8% of cases with a known attacker and Qilin 14.2%.¹⁰

03Where: industry, and North America first

Industrial firms were 31% of August’s victims, almost a third; consumer goods and services 18%, healthcare 12%, information technology 11% and financial services 6%.¹ Industry has led every month of the summer: 28% in June and 28% in July.²³ Our reading, not NCC’s: a stopped production line costs money by the hour, which is pressure to settle fast.

Asia’s 13% of 1,073 is about 139 victims (our arithmetic). In June NCC counted 133 in Asia, then 20% of a smaller month.² The share fell because North America and Europe grew; the number of Asian victims held steady. NCC publishes no figure for India.

04Fewer pay, and the typical payment halved

More victims has not meant more money. Verizon’s 2026 Data Breach Investigations Report, built on more than 22,000 confirmed breaches across 145 countries, found ransomware in 48% of breaches, up from 44% a year earlier, and found that 69% of ransomware victims did not pay.⁵ Coveware’s caseload shows the same direction quarter by quarter: 23% of its clients paid in the third quarter of 2025, a historical low;⁹ about 20% in the fourth, a new low;⁸ 23% in the first quarter of 2026;⁷ and in the second, a rate that “sunk to a new record low”.⁶ Where the attacker only stole data and encrypted nothing, 15% paid.⁶

The two lines say different things, and the median is the one to plan with. Coveware’s median payment fell 50% in the second quarter to US$150,000; the average rose 176% to US$1,880,612.⁶ Coveware had already warned that its average is skewed by “a small number of outsized settlements”.⁸ Insurers see the longer trend: Cowbell’s 2026 claims report says ransomware attacks rose 45% in 2025 while average payments fell roughly 44% between 2022 and 2025.¹⁰

05Restore, Stop, Prove: what changes for backup, detection and response

A theft-only attack needs no malware on a server and nothing to decrypt. ShinyHunters, second in Coveware’s caseload, is the clean example: Microsoft describes callers “impersonating IT support personnel” who talk staff into approving an app “disguised as a legitimate Salesforce Data Loader tool”, followed by “mass exfiltration of sensitive CRM records”. Microsoft adds that this “was not the result of a vulnerability inherent to Salesforce.”¹¹ Your backup is untouched and useless against it. We call the buyer’s test Restore, Stop, Prove: three questions, each needing a different product.

Restore still matters, because the big groups still encrypt. The change is that a restore must be clean and the copy must survive a stolen admin login. Coveware’s second-quarter advice puts phishing-resistant MFA on backup admin accounts and calls for “clear authority over backups, isolation, rebuilds, and business restoration”.⁶ In our cyber-recovery guide, 6 of 15 products document an immutability lock nobody can lift during retention, 7 scan backups for malware before a restore, and 3 document an isolated clean room to recover into.¹⁸

Stop is the leg most budgets underfund. It means watching and blocking data on its way out: auditing OAuth grants and API tokens, treating network discovery as an early alarm,⁶ and data loss prevention that can block rather than only report. Ransomware rollback in an endpoint agent, which 12 of the 36 products in our endpoint guide document,²⁰ undoes encryption; it does nothing about a file already copied out.

Prove is what the lawyers, the regulator and the extortionist all ask next: what exactly left, and whose data was it. Coveware lists the ability to “assess exfiltration quickly” next to containment.⁶ That answer comes from logs kept long enough and from knowing where sensitive data lives, which is a purchase decided before the incident, not during it.