Ransomware: record 2,760 victims in Q3 2026 as payment rates fall

GuidePoint Security's GRIT Q3 2026 Ransomware and Cyber Threat Insights Report, published on 8 October 2026, records 2,760 victims claimed on leak sites in the third quarter, up 21% on the second quarter and 75% on the same quarter of 2025. The count of active groups reached 112, a 23% rise quarter on quarter and 47% year on year.

Two groups, The Gentlemen (12.9% of victims) and Qilin (12.6%), accounted for about one victim in four. Victims were spread across 115 countries, the United States first at 42%. Manufacturing stayed the most affected industry, followed by technology and healthcare; banking and finance re-entered the top ten, in part because of a social-engineering campaign targeting private equity firms.

The payment picture moved the other way: the rate of victims who pay fell by more than half year on year, while the average payment among those who did pay rose 34%. GuidePoint also notes nearly 1,000 vulnerability disclosures in a single September update and assesses that AI is beginning to shorten the time between initial access and impact for some attackers.

Why it matters Leak-site counts measure claims, not confirmed intrusions, and a crowded field of 112 groups means affiliates move between brands. For an organisation, the useful questions are which groups target its sector and region, and how its name would surface on a leak site, both of which Dark Web monitoring can answer before an extortion note arrives.