Loading story…
Confirmed ransomware activity has remained persistently high worldwide, with a Ransomnews dataset logging 9,291 verified attacks since 2018 and roughly 1,400 to 1,550 incidents annually since 2023. LockBit remains the leading group by confirmed victims since 2019, while Qilin leads 2026 year-to-date with 53 confirmed victims, followed closely by The Gentlemen with 51. The United States accounts for about half of confirmed attacks in the dataset, and healthcare remains one of the most heavily affected sectors, with 1,297 confirmed healthcare incidents recorded across the full period.
Attacks on healthcare accelerated further in the first half of 2026, with overall incidents rising 14% and attacks on healthcare businesses and service providers jumping 35% from the second half of 2025 and 110% from a year earlier. Reporting attributes the shift to criminals targeting central vendors and service providers to reach multiple downstream hospitals and steal large volumes of sensitive data; recent examples include incidents involving University of Mississippi Medical Center, Unimed, TriZetto Provider Solutions, and QualDerm Partners. Security leaders say hospitals and clinics still face chronic exposure from legacy medical devices, patching constraints, third-party dependence, limited budgets and staffing, and social-engineering attacks, raising the risk of operational disruption and patient-care delays.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A July 2026 summary of the Ransomnews dataset reports 9,291 verified ransomware attacks worldwide from January 2018 through July 2026. The article also states that the United States accounts for about half of all confirmed attacks and that healthcare totals 1,297 incidents across the dataset.
The dataset summary says Qilin leads 2026 year-to-date with 53 confirmed victims, followed closely by The Gentlemen with 51.
According to the dataset summary, confirmed ransomware activity has stayed elevated since 2023 at roughly 1,400 to 1,550 attacks per year.
The reporting identifies a notable dip in confirmed ransomware activity in 2022 and associates it with the Conti shutdown and disruption stemming from the Russia-Ukraine war.
Reporting says cyberattacks against the healthcare sector increased in the first half of 2026, with healthcare businesses and service providers seeing much faster growth than hospitals and clinics. One cited dataset says healthcare attacks rose 14% overall, while attacks on healthcare businesses rose 35% from the second half of 2025 and 110% year over year.
The Ransomnews dataset summarized in the reporting covers confirmed ransomware incidents worldwide starting in January 2018, using victim disclosures, regulatory filings, official statements, and credible press reporting as inclusion criteria.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
health-isac.org
Open sourcesecurityaffairs.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026
Recent reporting highlights a shift in enterprise cyber risk toward **external dependencies and identity abuse**. Coverage of the EU’s **NIS2** directive emphasizes that organizations are expected to treat **supply-chain security** as a core governance and architecture issue, reflecting the reality that third parties (e.g., cloud providers, software suppliers, maintenance access, and outsourced services) are frequent intrusion paths rather than risks contained “inside the firewall.” Separately, findings cited from Eye Security’s *State of Incident Response Report 2026* indicate attackers are increasingly **exploiting existing access** rather than “hacking in,” with **identity-based attacks** dominating and **passwords** implicated in the vast majority of such incidents; common initial compromise paths still include phishing, exposed/misconfigured internet-facing systems, social engineering, and software supply-chain attacks. In healthcare, a Trellix threat intelligence report based on **54.7 million detections** from 2025 healthcare environments warns cyber incidents are escalating from IT disruption into a **patient safety** issue due to highly interconnected systems and “cascading” outages. The report identifies **email** as the leading threat vector and the **U.S.** as the primary target, and describes ransomware and extortion activity intensifying, including groups such as **Qilin** (noted for targeting EHR databases), **INC Ransom**, and newer actors like **Sinobi** focusing on biotech; it also reports a sharp rise in **extortion-only** tactics with per-patient ransom demands intended to sidestep corporate insurance dynamics. Across these sources, **phishing** remains a dominant initial access method, with lures increasingly tailored to privileged IT roles (e.g., “AI Transformation” themes).
Jul 12, 2026
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026