Comparitech’s Q3 roundup

In Q3 2026, ransomware attacks on the healthcare sector reached a new high with an average of 3.33 attacks per day . Attacks rose by 40 percent when compared to Q2 2026 (rising from 219 to 306) and more than doubled from 151 to 306, when compared to the same period last year (Q3 2025).

192 of the 306 attacks noted in Q3 2026 were on hospitals, clinics, and other direct care providers. 114 were carried out on businesses operating within the healthcare sector, such as pharmaceutical/medical manufacturers, medical billing providers, and healthcare tech companies.

The increase in attacks over the last quarter was slightly higher for direct-care providers (up 42 percent) when compared to healthcare businesses (up 36 percent).

Of the healthcare businesses targeted, healthcare manufacturers remained a key target with 51 attacks throughout Q3 2026 – up 28 percent from Q2 2026 (40). But healthcare technology companies saw the biggest increase with a rise of 175 percent from eight attacks in Q2 2026 to 22 in Q3 2026.

Healthcare not only remains a focus for hackers but is seeing an above-average increase in the volume of attacks carried out. Our Q3 2026 report , which covers all sectors, found a 29 percent increase from Q2 to Q3 2026 and a 61 percent increase on the same period last year (Q3 2025).

*Please note: this report was written after our Q3 2026 report, so figures may have changed slightly as more attacks have been confirmed.

Key findings for Q3 2026 ransomware attacks on the healthcare sector

152 unconfirmed attacks

618,149 records are known to have been breached in the confirmed attacks

Median ransom demand: $300,000

The most prolific ransomware strains with the highest number of claims against healthcare providers were The Gentlemen (18), INC (14), KRYBIT and Storm (11 each), and Qilin and Dire Wolf (10 each)

Chaos had the most confirmed attacks (5), followed by INC and The Gentlemen (3 each)

Healthcare businesses

101 unconfirmed attacks

No records are known to have been breached in the confirmed attacks

Median ransom demand of $150,000

The most prolific ransomware strains with the highest number of claims against healthcare companies were Qilin (15) and The Gentlemen (13)

Chaos had the most confirmed attacks (3), followed by The Gentlemen (2)

The top 5 biggest healthcare data breaches via ransomware in Q3 2026

The following healthcare providers had the biggest breaches (via a ransomware attack) in Q3 2026:

Saber Healthcare Group, US – 427,084 people affected: In July 2026, Saber confirmed that a “small portion” of its files had been encrypted in a cyber attack. This led to a service outage but it was said that there was “no evidence that the medical record database was accessed, modified, or copied.” However, in late September, Saber began notifying over 427,000 people of a breach involving medical data, health insurance information, Social Security numbers, and more.

Osceola Mental Health d/b/a Park Place Behavioral Healthcare, US – 71,702 people affected: Data breach notifications were issued to over 70,000 patients after an attack in July 2026 with financial information, medical data, and more affected. This was claimed by the group Insomnia.

Hawaii Family Dental, US – 45,853 people affected: Qilin claimed this July 2026 attack on the dental practice. Medical data was impacted but SSNs and financial account information were not.

WindRose Health Network, US – 33,158 people affected: In August, hackers were able to access WindRose’s systems through an undisclosed vulnerability in the remote-management tool it uses. Over 33,000 people were later notified of the breach, which was claimed by Storm.

Vernon & Waldrep OB-Gyn Associates, US – 17,435 people affected: Patients at the clinic were warned of a breach from July in which medical information, including treatment and diagnosis information, was potentially affected. Global Secret Group claimed the attack and said 274 GB of data had been stolen.

Three other figures were provided in the cases of US companies Pavillon International Inc. (8,813 affected after a July 2026 attack claimed by Global Secret Group), Bright Smile Dental Care, Ltd. (7,601 people affected after an August 2026 attack – unknown hackers), and Gardiner Family Chiropractic (5,000 people affected after a July 2026 attack claimed by Interlock).

AnMed , Hospitality Health ER (Longview) , and Level Medical, LLC also issued breach notifications with a 501 placeholder added to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) tool.

Ransom demands on healthcare companies in Q3 2026

No ransom payments were officially confirmed during this reporting period. Five entities confirmed they hadn’t paid a ransom in their attacks.

In July, Stiftung Wagerenhof in Switzerland confirmed it hadn’t met its hackers’ demands. The group behind the attack remains unknown. Gardiner Family Chiropractic, mentioned above, also refused to pay its hackers (Interlock).

Guatemala’s national cancer institute ( Instituto Nacional de Cancerología ) was targeted in August by KRYBIT. It refused to pay the group’s ransom. KRYBIT later added INCAN to its site and said it had stolen 78.11 GB of data.

Nipigon District Memorial Hospital in Canada and APSP San Gaetano in Italy were both targeted in September and confirmed they hadn’t paid their hackers’ ransoms. The group behind the attack on APSP remains unknown, while Nipigon was claimed by Storm.

Ransomware attacks on healthcare companies by country

Of the 306 attacks on healthcare providers and businesses, the US saw the highest number: 185 in total. 26 of these attacks were confirmed with 23 of them being on healthcare providers.

Attacks in the US increased by 64 percent from Q2 to Q3 2026.

Canada (10) and India (9) followed with their total number of attacks, and Germany, Turkey, and Italy with seven attacks each. Italy (up 600 percent) and Turkey (up 250 percent) saw some of the biggest increases in attacks, while attacks in Germany declined by 42 percent.

Which ransomware gangs are targeting healthcare providers and/or businesses?

As we’ve already seen, the most dominant strains varied. The Gentlemen and INC were the most dominant on healthcare providers, while Qilin and The Gentlemen were the most dominant on healthcare businesses.

Chaos was the most confirmed strain across both providers and businesses, however.

Five of its attacks on healthcare providers (all US-based) were confirmed:

Mankato Clinic Ltd. – targeted in September 2026 with 610 GB allegedly stolen

Radia Inc., P.S. – targeted in July 2026 with 655 GB allegedly stolen

Park Dental Partners, Inc. – targeted in August 2026 with 275 GB allegedly stolen

Central Ohio Primary Care – targeted in August 2026 with 362 GB allegedly stolen

Astrana Health, Inc. – targeted in September 2026 with 1.5 TB allegedly stolen

And three attacks on healthcare businesses:

The Craneware Group, UK – targeted in July 2026 with 960 GB allegedly stolen.

Neopharm Labs Inc., Canada – targeted in July 2026 with 627 GB allegedly stolen

Healthcare Highways, LLC, US – targeted in July 2026 with 235 GB allegedly stolen

Five of The Gentlemen’s attacks were also confirmed. As well as AnMed (mentioned above), another US healthcare provider ( Nutex Health Inc. ) confirmed an attack in August 2026 and healthcare tech company Veradigm Inc. also confirmed an attack in September 2026. Elsewhere, Taiwanese healthcare manufacturer PharmaEssentia (Panco Healthcare) confirmed an attack in August 2026 and Polish pharmacy Zdrowit S.A. confirmed an attack in September 2026.

Confirmed vs unconfirmed attacks

We label a ransomware attack as “confirmed” when a) the targeted organization publicly discloses an attack that involved ransomware, or b) the targeted organization publicly acknowledges a cyber attack that matches a claim made by a ransomware group. If a ransomware group claims that it successfully attacked an organization, but the organization never acknowledged an attack, then we label the attack as “unconfirmed.”

An attack might be unconfirmed because the ransomware group making the claim is lying, or because the targeted organization chose not to disclose the attack to the public. Ransomware groups post their attack claims on their respective websites, where the data is auctioned or released when organizations don’t meet their ransom demands.

Organizations in the US are required to disclose data breaches, which often result from ransomware attacks, to state officials when they meet certain thresholds. Not all countries have breach disclosure laws.

When an attack is confirmed, it is removed from our list of unconfirmed attacks. Therefore, we must allow for some changes in figures when comparing monthly data, especially when using unconfirmed attacks. Claims from ransomware groups often come a month after the attack, if not longer. For example, if a ransomware gang claims an attack in January 2026, it may later be confirmed as an attack in December 2025 and will, therefore, be attributed to a different month.

All data is derived from our worldwide ransomware tracker (updated daily) – here .