---
title: "Ransomware victims hit 1,073 in August, the year's high; most don't pay"
summary: "NCC Group's victim counts, Coveware's payment data and Verizon's DBIR, January to August 2026, and what they change for backup, detection and response."
url: https://www.thetechbag.com/blog/ransomware-high-august-most-victims-dont-pay
format: Analysis
desk: "Security operations"
published: 2026-09-24
facts_checked: 2026-09-24
author: TechBag (The TechBag Journal)
tags: ["ransomware","data extortion","NCC Group","Coveware","Verizon DBIR","Qilin","The Gentlemen","ShinyHunters","cyber recovery","DLP","Bajaj Auto","CERT-In","SEBI LODR"]
cover: https://www.thetechbag.com/blog/covers/ransomware-high-august-most-victims-dont-pay.png
---

# Ransomware victims hit 1,073 in August, the year's high; most don't pay

*NCC Group's victim counts, Coveware's payment data and Verizon's DBIR, January to August 2026, and what they change for backup, detection and response.*

Analysis · Security operations · By TechBag · Published 2026-09-24 · Facts checked 2026-09-24 · Canonical: https://www.thetechbag.com/blog/ransomware-high-august-most-victims-dont-pay

The short version

- NCC Group recorded 1,073 ransomware victims in August, the most of any month this year and 12% more than July, which had itself been the year’s high. Industrial firms were 31% of them; North America 44%, Asia 13%.[1]
- Paying has become the exception. In Verizon’s 2026 breach report, 69% of ransomware victims did not pay.[5] Coveware says the share of its clients who paid hit a new record low in the second quarter, and the median payment halved to US$150,000.[6]
- The groups’ answer is to steal rather than only lock. That moves the buyer’s question from “can we restore?” to three: can we restore clean, can we stop data leaving, and can we prove what left. Of 15 cyber-recovery products in TechBag’s guide, 3 document a clean room to restore into.[18]

Two numbers that look as if they cannot both be true moved together this year: more organisations named as ransomware victims, and fewer of them paying. If you run IT or security, the question is what that combination says about the attack you should plan for, and whether the backup, detection and response you bought for the old attack still covers the new one. We read NCC Group’s monthly counts, three quarters of Coveware’s incident data, Verizon’s Data Breach Investigations Report and one Indian disclosure, and set them against what the products in our guides document. Our earlier piece on [why 3-2-1 backup is not enough](https://www.thetechbag.com/blog/321-backup-rule-essential-data-protection) covers attacks on the backups themselves; this one is about the attack that does not need them.

## 1,073 in August: the second record month in a row

NCC Group counted 2,165 ransomware attacks in the first quarter of 2026 and 2,229 in the second, a rise of 3%.[2] That is a flat year: about 720 to 740 a month. Then the summer broke the pattern. NCC’s August report puts July at 973 and August at 1,073, 12% higher, and its head of cyber intelligence, Matt Hull, called August “the second consecutive month of highest ransomware levels for the year.”[1] He put it down to “rapid advancements in AI and ongoing geopolitical volatility”; NCC gives no measurement behind that attribution, so we treat it as the firm’s view.

**Figure: After a flat first half, July and August each set the year's high**

*Ransomware attacks recorded by NCC Group: monthly average for each quarter, then July and August 2026*

|  | Attacks recorded |
| --- | --- |
| Q1 avg | 722 |
| Q2 avg | 743 |
| July | 973 |
| August | 1,073 |

Source: NCC Group, Threat Pulse for June (Q1 and Q2 totals) and for August 2026, via Infosecurity Magazine · as of 23 September 2026 · Q1 and Q2 bars are quarterly totals divided by three (TechBag arithmetic)

Two cautions before reading too much into it. August is a 2026 high, not an all-time one: NCC’s record month is still February 2025, at 1,099.[3] And the latest month is a floor, not a final count. When NCC first reported July, in late August, it gave 894 attacks;[3] a month later the same July stood at 973.[1] That is 79 more victims, 9%, added a month after the fact (our arithmetic). A victim that is never named publicly never enters a count like this at all.

## Who: one veteran, one newcomer and a long tail of brands

Five groups accounted for 455 of August’s 1,073 victims. Qilin led with 164; by NCC’s count it had been the most active group for five consecutive quarters to June.[1][2] The one to watch is second. The Gentlemen, a ransomware-as-a-service operation that GuidePoint says emerged in August 2025, went from 35 victims in the last quarter of 2025 to 182 in the first of 2026,[4] 238 in the second by NCC’s count,[2] and 116 in August alone.[1] A year from launch to the top two.

**Figure: The Gentlemen, a year-old brand, named the second-most victims in August**

*Ransomware victims attributed to each group by NCC Group, August 2026*

Qilin

164 victims

The Gentlemen

emerged August 2025

116 victims

Clop

89 victims

Dire Wolf

43 victims

INC Ransom

43 victims

|  | Value (victims) |
| --- | --- |
| Qilin | 164 |
| The Gentlemen | 116 |
| Clop | 89 |
| Dire Wolf | 43 |
| INC Ransom | 43 |

Source: NCC Group, Threat Pulse for August 2026, via Infosecurity Magazine · as of 23 September 2026

Below the top five, the names churn. NCC flagged a new group, CRPxO, claiming 36 victims in July, and warned that its evidence was inconsistent and that new groups often exaggerate.[3] Another newcomer, KryBit, entered NCC’s top ten in the second quarter.[2] And the league table depends on who is counting. Coveware, which negotiates for victims, saw a different top five in its second-quarter cases: Lone Wolf 17%, ShinyHunters 12%, Akira 9%, The Gentlemen 8% and DragonForce 4%.[6] In Cowbell’s insurance claims, Akira was behind 38.8% of cases with a known attacker and Qilin 14.2%.[10]

Our view

Our view: a leak-site count measures who names victims; an incident-response caseload measures who hits companies that call for help. Neither is the whole market. For a buyer the useful conclusion is the churn itself. A defence built on knowing this year’s group names ages in months; one built on how they get in and what they take does not.

## Where: industry, and North America first

Industrial firms were 31% of August’s victims, almost a third; consumer goods and services 18%, healthcare 12%, information technology 11% and financial services 6%.[1] Industry has led every month of the summer: 28% in June and 28% in July.[2][3] Our reading, not NCC’s: a stopped production line costs money by the hour, which is pressure to settle fast.

**Figure: North America and Europe held 70% of August's victims; Asia had 13%**

*Share of ransomware victims by region, August 2026*

- North America44% 44%
- Europe26% 26%
- Asia13% 13%
- South America6% 6%
- Other or unassigned11% 11%

|  | Value (%) | Share |
| --- | --- | --- |
| North America | 44 | 44% |
| Europe | 26 | 26% |
| Asia | 13 | 13% |
| South America | 6 | 6% |
| Other or unassigned | 11 | 11% |

Source: NCC Group, Threat Pulse for August 2026, via Infosecurity Magazine · as of 23 September 2026 · Other = Africa 2%, Oceania 2% and the 7% NCC did not assign to a region

Asia’s 13% of 1,073 is about 139 victims (our arithmetic). In June NCC counted 133 in Asia, then 20% of a smaller month.[2] The share fell because North America and Europe grew; the number of Asian victims held steady. NCC publishes no figure for India.

## Fewer pay, and the typical payment halved

More victims has not meant more money. Verizon’s 2026 Data Breach Investigations Report, built on more than 22,000 confirmed breaches across 145 countries, found ransomware in 48% of breaches, up from 44% a year earlier, and found that 69% of ransomware victims did not pay.[5] Coveware’s caseload shows the same direction quarter by quarter: 23% of its clients paid in the third quarter of 2025, a historical low;[9] about 20% in the fourth, a new low;[8] 23% in the first quarter of 2026;[7] and in the second, a rate that “sunk to a new record low”.[6] Where the attacker only stole data and encrypted nothing, 15% paid.[6]

**Figure: The median payment halved to US$150,000 while a few big settlements pushed the average to US$1.9m**

*Median and average ransom paid in Coveware cases, US$ thousand, Q3 2025 to Q2 2026*

|  | Average | Median |
| --- | --- | --- |
| Q3 2025 | 377 | 140 |
| Q4 2025 | 592 | 325 |
| Q1 2026 | 680 | 301 |
| Q2 2026 | 1,881 | 150 |

Source: Coveware quarterly reports, October 2025 to July 2026 · as of 29 July 2026

The two lines say different things, and the median is the one to plan with. Coveware’s median payment fell 50% in the second quarter to US$150,000; the average rose 176% to US$1,880,612.[6] Coveware had already warned that its average is skewed by “a small number of outsized settlements”.[8] Insurers see the longer trend: Cowbell’s 2026 claims report says ransomware attacks rose 45% in 2025 while average payments fell roughly 44% between 2022 and 2025.[10]

ReportedReported: the incentive that follows

When encryption stops paying, stolen data is what the attacker has left to bargain with. Coveware ranks exfiltration as the main pressure tactic in its first-quarter cases, seen in 73%,[7] and found data had been taken in 94% of incidents in late 2025.[8] NCC says some groups have moved to “outright data theft and extortion”, without encryption;[1] GuidePoint: “Data extortion-only attacks are increasing.”[4]

## Restore, Stop, Prove: what changes for backup, detection and response

A theft-only attack needs no malware on a server and nothing to decrypt. ShinyHunters, second in Coveware’s caseload, is the clean example: Microsoft describes callers “impersonating IT support personnel” who talk staff into approving an app “disguised as a legitimate Salesforce Data Loader tool”, followed by “mass exfiltration of sensitive CRM records”. Microsoft adds that this “was not the result of a vulnerability inherent to Salesforce.”[11] Your backup is untouched and useless against it. We call the buyer’s test **Restore, Stop, Prove**: three questions, each needing a different product.

**Restore** still matters, because the big groups still encrypt. The change is that a restore must be clean and the copy must survive a stolen admin login. Coveware’s second-quarter advice puts phishing-resistant MFA on backup admin accounts and calls for “clear authority over backups, isolation, rebuilds, and business restoration”.[6] In our cyber-recovery guide, 6 of 15 products document an immutability lock nobody can lift during retention, 7 scan backups for malware before a restore, and 3 document an isolated clean room to recover into.[18]

**Figure: Only 3 of 15 cyber-recovery products document a clean room; fewer than half scan backups before restore**

*Capabilities documented by the vendor, 15 cyber-recovery products, as of September 2026*

Malware scan of backups before restore

7

8

15 products

Immutability lock nobody can lift

6

9

15 products

Anomaly or encryption detection

6

9

15 products

India data region documented

4

11

15 products

Isolated clean-room recovery

3

12

15 products

|  | Documented | Not documented or not applicable |
| --- | --- | --- |
| Malware scan of backups before restore | 7 | 8 |
| Immutability lock nobody can lift | 6 | 9 |
| Anomaly or encryption detection | 6 | 9 |
| India data region documented | 4 | 11 |
| Isolated clean-room recovery | 3 | 12 |

Source: TechBag Cyber Recovery guide, vendor documentation verified 22 August 2026 · as of 24 September 2026 · Two of the 15 are detection services that hold no data, so the lock does not apply to them

**Stop** is the leg most budgets underfund. It means watching and blocking data on its way out: auditing OAuth grants and API tokens, treating network discovery as an early alarm,[6] and data loss prevention that can block rather than only report. Ransomware rollback in an endpoint agent, which 12 of the 36 products in our endpoint guide document,[20] undoes encryption; it does nothing about a file already copied out.

**Prove** is what the lawyers, the regulator and the extortionist all ask next: what exactly left, and whose data was it. Coveware lists the ability to “assess exfiltration quickly” next to containment.[6] That answer comes from logs kept long enough and from knowing where sensitive data lives, which is a purchase decided before the incident, not during it.

TechBag countTechBag count: the Stop leg in our guides

Of 18 DLP and insider-risk products in our guide, 12 document a blocking mode; 3 stop at coaching users and 3 at monitoring.[19] In the endpoint guide, 12 of 36 document ransomware rollback, 5 restore from a backup instead, 3 only contain, 8 have none and 8 are unverified.[20] Counts are of vendor documentation, not of tests.

If you are buying this in India

India’s clearest 2026 case is a listed manufacturer. On 23 June Bajaj Auto told the stock exchanges that “a cyber security incident has occurred that involve a ransomware attack impacting the systems of Bajaj Auto Limited” and of its wholly owned subsidiary, Bajaj Auto Technology Limited. The incident “occurred on 23 June 2026 at around 08:00 a.m. (IST) and has been intimated to CERT-In in terms of the Information Technology Act, 2000”. The company said it had taken precautionary actions that, on the information available, had worked, and that the disclosure was made under Regulation 30 of SEBI’s Listing Obligations and Disclosure Requirements (LODR) Regulations and “as a matter of good governance.”[12][13] It named no group, and did not say whether data was taken or production stopped.[12]

That is the template a listed Indian company now follows, and each step is a separate duty. CERT-In’s Directions of 28 April 2022 require any body corporate to report incidents in Annexure I, which lists “Ransomware”, “within 6 hours of noticing” them, and to keep logs of all ICT systems “for a rolling period of 180 days” within Indian jurisdiction.[14] Regulation 30 governs disclosure of material events to the exchanges. Separately, since 13 July 2023, LODR Regulation 27(2)(ba) requires the quarterly corporate-governance report to disclose cyber security incidents, breaches or loss of data, with the date and brief details.[15] A theft-only attack on customer records will also fall under the DPDP Rules: Rule 7, in force from 13 May 2027, requires a detailed report to the Data Protection Board “within seventy-two hours of becoming aware of the breach.”[16][17]

For an Indian buyer, the 180-day log rule is the Prove leg written into law: if your logs cannot say what left, you cannot answer CERT-In, the exchange or, from 2027, the Board. Two more checks belong in the shortlist. Only 4 of the 15 cyber-recovery products and 6 of the 18 DLP products in our guides document an India data region or Indian residency;[18][19] the rest may still offer one, so ask in writing. And NCC publishes no India figure, so Asia’s steady count of about 139 victims a month is the nearest regional measure; we do not estimate an Indian share from it.

How we did this

Figures as of 24 September 2026

Written as of 24 September 2026, using only documents public by then. NCC Group’s August figures (total, groups, sectors and regions) are as reported by Infosecurity Magazine on 23 September; NCC’s own August page was not found. Q1, Q2, June and July figures are from NCC’s newsroom releases of 22 July and 26 August. The Q1 and Q2 bars are quarterly totals divided by three; the Asia count, the 455 and the July revision are our arithmetic. NCC’s regional shares sum to 93%; the rest is shown as unassigned. Coveware’s payment rates and amounts are quoted from its quarterly posts; its Q2 2026 overall payment rate is shown only in a chart and is not given as a number here, and the Q2 post’s date is as displayed on the page. GuidePoint’s Q1 2026 page carries no publication date. Verizon’s DBIR is read through Help Net Security; the PDF was not read. Bajaj Auto’s wording is as Business Today and Autocar Pro reproduced the filing. The product counts are TechBag’s, from the cyber-recovery (15 products), DLP and insider-risk (18) and endpoint (36) guides as they stood on this date, counting documented capability only. Excluded: unread secondary claims, including a widely repeated share of incidents with no encryption.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Infosecurity Magazine (Danny Palmer): ransomware attacks reach 2026 high, reporting NCC Group's Cyber Threat Intelligence Report for August 2026](https://www.infosecurity-magazine.com/news/ransomware-attacks-reach-record/) — 23 September 2026
2. [NCC Group: Monthly Threat Pulse, review of June 2026 (Q1 and Q2 totals)](https://www.nccgroup.com/newsroom/ncc-group-monthly-threat-pulse-review-of-june-2026/) — 22 July 2026
3. [NCC Group: Monthly Threat Pulse, review of July 2026](https://www.nccgroup.com/newsroom/ncc-group-monthly-threat-pulse-review-of-july-2026/) — 26 August 2026
4. [GuidePoint Security: GRIT Q1 2026 Ransomware & Cyber Threat Insights Report](https://www.guidepointsecurity.com/resources/grit-q1-2026-ransomware-cyber-threat-insights-report/) — covers Q1 2026 Page undated.
5. [Help Net Security: lessons from Verizon DBIR 2026 findings](https://www.helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings/) — 25 May 2026
6. [Coveware: Adverse cyber extortions are more common than commonly advised (Q2 2026 report)](https://coveware.com/2026/07/adverse-cyber-extortions-are-more-common-than-commonly-advised/) — 29 July 2026 Date as displayed on the page.
7. [Coveware: Patch management goes from hard, to ludicrous in the agentic AI era (Q1 2026 report)](https://coveware.com/2026/04/patch-management-goes-from-hard-to-ludicrous-in-the-agentic-ai-era/) — 30 April 2026
8. [Coveware: Why Zero-Day Downstream Mass Data Extortion Campaigns are Losing Their Bite (Q4 2025 report)](https://coveware.com/2026/02/why-zero-day-downstream-mass-data-extortion-campaigns-are-losing-their-bite/) — 3 February 2026
9. [Coveware: Insider Threats Loom while Ransom Payment Rates Plummet (Q3 2025 report)](https://coveware.com/2025/10/insider-threats-loom-while-ransom-payment-rates-plummet/) — 24 October 2025
10. [Insurance Journal (Allen Laman): Cowbell 2026 claims report](https://www.insurancejournal.com/news/national/2026/05/08/869023.htm) — 8 May 2026
11. [Microsoft Security Blog: Defending SaaS-based applications against ShinyHunters OAuth abuse](https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/) — 13 July 2026
12. [Business Today: What Bajaj Auto ransomware attack says about cyber security risks for Indian automakers (quotes the exchange filing)](https://www.businesstoday.in/auto/story/what-bajaj-auto-ransomware-attack-says-about-cyber-security-risks-for-indian-automakers-538956-2026-06-24) — 24 June 2026
13. [Autocar Professional: Bajaj Auto reports ransomware attack, says operations safeguarded after swift response](https://www.autocarpro.in/news/bajaj-auto-reports-ransomware-attack-says-operations-safeguarded-after-swift-response-133210) — 23 June 2026
14. [CERT-In, Directions under sub-section (6) of section 70B of the IT Act, 2000 (No. 20(3)/2022-CERT-In), paras (i), (ii), (iv) and Annexure I](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 Effective 60 days from issue.
15. [Vinod Kothari Consultants: Cyber security incidents to be reported quarterly to stock exchanges (LODR Regulation 27(2)(ba), Second Amendment Regulations of 14 June 2023; exchange format of 29 September 2023)](https://vinodkothari.com/2023/10/cyber-security-incidents-to-be-reported-quarterly-to-stock-exchanges/) — 4 October 2023
16. [Digital Personal Data Protection Rules, 2025, Rule 7 (intimation of personal data breach), text of G.S.R. 846(E)](https://dpdpa.com/dpdparules/rule7.html) — 13 November 2025 Reproduction of the Gazette text.
17. [DPDP Rules 2025 commencement timeline (Rule 7 from 13 May 2027)](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025
18. [TechBag, Cyber Recovery guide: 15 products; immutability, malware scanning, clean-room and India-region fields](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — vendor documentation verified 22 August 2026
19. [TechBag, DLP & Insider Risk guide: 18 products; enforcement mode and India-region fields](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — vendor documentation verified 24 August 2026
20. [TechBag, Endpoint Protection guide: 36 products; ransomware rollback field](https://www.thetechbag.com/browse/security/endpoint-protection) — vendor documentation verified 22 August 2026

Related on TechBag: the [Cyber Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) compares immutability, scanning and clean rooms across 15 products; the [DLP & Insider Risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) covers the tools that stop data leaving; the [Endpoint Protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) records which agents roll back encryption.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Cyber Recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — immutability, malware scanning and clean rooms across 15 products
- [DLP & Insider Risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — the tools that stop data leaving, and which of them can block
- [Endpoint Protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — which of 36 agents document ransomware rollback