Ransomware Attacks Surge in August 2026 with 1,034 Victims Worldwide

Cxotoday

Ransomware Attacks Surge in August 2026 with 1,034 Victims Worldwide

First seen 28 Sep 2026, 22:06 UTC • •66.5

Article Content

1 / 4

Browse articles

ThreatCluster •September 28, 2026 at 23:08 UTC

•August 2026 saw a record 1,034 ransomware victims globally, averaging 33 per day.
•The United States accounted for 484 victims, while India was the most targeted in Asia-Pacific with 24.
•Manufacturing and IT sectors were among the most affected, highlighting vulnerabilities in operational downtime.

In August 2026, ransomware activity reached a record high, with 1,034 organizations globally identified as victims, according to Cyble Research and Intelligence Labs (CRIL). This represents an average of 33 victims per day and marks a significant increase after a three-month decline. The United States was the most affected country, with 484 victims, while India led in the Asia-Pacific region with 24 victims, ranking seventh worldwide. Key sectors impacted included manufacturing, professional services, IT and IT-enabled services, and healthcare. The report indicates that ransomware activity rose by 60% in July and an additional 25% in August, suggesting a new baseline for ransomware threats. The increase is attributed to the operational vulnerabilities of targeted sectors, which handle sensitive client data and face severe downtime costs. Notably, the Gentlemen gang led in the Asia-Pacific region, claiming 20 victims, while Qilin, the most active gang globally, had 16 victims in the region.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-08-01

Ransomware activity spikes

Ransomware incidents rose sharply, reversing a three-month decline with 1,034 victims reported in August.

2026-09-28

Cyble report published

Cyble Research and Intelligence Labs released a report detailing the surge in ransomware attacks for August 2026.

More articles in this cluster (3)

Threat Graph

9 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Ransomware
T1041 - Exfiltration Over C2 Channel
T1486 - Data Encrypted for Impact

Affected Platform (1)

Windchill

Threat Actor (5)

Cl0p
Krybit
Orova
Qilin
The Gentlemen

Relationships

Cl0p uses Ransomware
Cl0p uses T1041 - Exfiltration Over C2 Channel
Cl0p uses T1486 - Data Encrypted for Impact
Krybit uses Ransomware
Krybit uses T1041 - Exfiltration Over C2 Channel
Krybit uses T1486 - Data Encrypted for Impact
Orova uses Ransomware
Orova uses T1041 - Exfiltration Over C2 Channel
Orova uses T1486 - Data Encrypted for Impact
Qilin uses Ransomware
Qilin uses T1041 - Exfiltration Over C2 Channel
Qilin uses T1486 - Data Encrypted for Impact
The Gentlemen uses Ransomware
The Gentlemen uses T1041 - Exfiltration Over C2 Channel
The Gentlemen uses T1486 - Data Encrypted for Impact
Cl0p related to Windchill

Following this threat?

Track Cl0p in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cleo Harmony Vulnerability Exploited for Privilege Escalation A newly discovered authentication bypass vulnerability in Cleo Harmony, tracked as CVE-2026-84115, allows remote attackers to escalate privileges by manipulating JWT refresh tokens. The flaw, found in the '/api/connections' function, enables attackers to bypass access controls through crafted HTTP headers. An exploit…

Kiteworks Issues Urgent Shutdown Advisory Amid Zero-Day Threat Kiteworks has alerted its customers to shut down their servers due to credible threat intelligence indicating an imminent cyberattack exploiting a zero-day vulnerability. The advisory, which applies globally, recommends a six-hour shutdown window starting September 26, 2026. This precautionary measure comes as…