Ransomware Attacks Surge After a Spring Slowdown
Ransomware activity snapped back with a vengeance in July. New data from Comparitech shows a 19% jump in claimed attacks compared to June, making last month the second-busiest of 2026 so far.
The numbers are stark. Researchers tracked 799 claimed ransomware attacks in July — the third-highest monthly total in the past 17 months. That spike follows an unusually quiet stretch from April through June, when activity dipped noticeably.
Finance took the hardest hit, with attacks soaring 71% month-over-month. Technology wasn’t far behind at 62%, while healthcare (46%) and education (44%) also saw sharp increases. US-based organizations felt the pressure too, with attacks up 31% from June.
Major Incidents Show the Damage Ransomware Can Do
Two confirmed attacks stood out for their real-world consequences. US healthcare provider AnMad was forced to close facilities after a breach. In Romania, the government’s land registry agency suffered an attack that wiped an entire database, throwing the country’s real estate market into chaos.
Rebecca Moody, head of data research at Comparitech, put it bluntly: “These attacks highlight how ransomware groups hit organizations in various different ways – taking down key systems, stealing troves of data, and even deleting massive datasets.”
Her advice? Regular backups — and backups of those backups. “Never has it been more important for organisations to ensure they’re carrying out regular backups… so they can reset systems and restore data as quickly as possible if the worst does happen,” she said.
The Gentlemen and Qilin Continue Their Battle for Supremacy
Two ransomware strains continue to dominate the threat landscape. The Gentlemen and Qilin together accounted for 33% of all attacks in July — 135 and 125 claims, respectively.
That’s a continuation of a power struggle that’s been brewing for months. ReliaQuest analysis from earlier this year found The Gentlemen had overtaken Qilin as the most prolific threat actor between March and May 2026.
The gap between these two and everyone else is significant. DragonForce came in third with 41 attacks, followed by INC (36), CRPx0 (33), and SafePay (30).
What This Means for Security Teams
The July numbers are a reminder that ransomware isn’t going anywhere. The lull in spring was temporary — these groups adapt, regroup, and strike when defenses drop.
For organizations in finance, healthcare, and tech, the message is clear: ransomware protection strategies need constant updating. That means patching vulnerabilities, segmenting networks, and testing recovery plans before an incident, not after.
It also means paying attention to who’s actually attacking. The dominance of The Gentlemen and Qilin suggests a consolidation in the ransomware ecosystem — fewer, bigger players with more resources and better tactics.
How to Prepare for the Next Wave
Comparitech’s data points to a few practical steps every organization should take:
- Maintain offline backups and test restoration procedures regularly
- Monitor threat intelligence feeds for emerging ransomware groups
- Implement strict access controls and multi-factor authentication
- Develop and rehearse an incident response plan specific to ransomware
- Consider cyber insurance that covers extortion payments and business interruption
The July surge is a warning shot. The spring lull lulled some into complacency — but the attackers never stopped. They were just waiting.
