State of Ransomware: July 2026
Published 1 August 2026 · ThreatVectr Intelligence
Ransomware groups claimed 995 attacks on organisations worldwide in July 2026, up 40% on the previous month's 713. 68 distinct groups posted at least one victim during the month, across 88 countries. The busiest single day was 10 July, with 104 victims listed.
The Gentlemen was the most active operation of the month, claiming 137 victims — 14% of all listings. Qilin (127) and DeadLock (84) followed. 9 groups appeared for the first time, including Global secret group, Crpxo, Zawoo, Section9.
Manufacturing bore the heaviest targeting, with 142 claimed victims, ahead of Technology (116) and Business Services (93). By geography, United States accounted for 340 claims — 34% of the month — with Germany (58) and United Kingdom (37) next.
Claims per day — July 2026
Most active groups
- 1The Gentlemen·13714%
- 2Qilin·12713%
- 3DeadLock20848%
- 4DragonForce4434%
- 5INC Ransom·384%
- 6CrpxoNew364%
- 7NightSpire5323%
- 8SafePay1323%
- 9Global secret groupNew313%
- 10Akira6253%
First seen this month:Global secret group, Crpxo, Zawoo, Section9, Exfilsquad, Gammax, Falcon, Blackout and 1 more
Most-targeted sectors
- 1Manufacturing142
- 2Technology116
- 3Business Services93
- 4Healthcare88
- 5Professional Services61
- 6Financial Services56
- 7Other40
- 8Agriculture and Food Production38
- 9Retail & E-Commerce36
- 10Consumer Services30
Most-affected countries
- 1United States340
- 2Germany58
- 3United Kingdom37
- 4Brazil34
- 5Canada32
- 6India28
- 7Italy27
- 8Spain22
- 9France22
- 10Argentina20
Every figure in this report counts a claim posted to a criminal leak site, observed via the monitoring service ransomware.live. A listing is an extortion tactic, not a confirmed breach: some claims are exaggerated, some are duplicates under new branding, and a few are outright false. Companies named in listings have not necessarily confirmed any incident, and ThreatVectr does not publish victim names from this dataset.
Cite this report
This report is free to cite and reproduce with attribution. Suggested citation:
ThreatVectr, “State of Ransomware: July 2026”, https://threatvectr.com/ransomware-tracker/reports/july-2026
Journalists and researchers: for questions about the data or methodology, contact the newsdesk.
Most ransomware starts with one email
The groups in this report overwhelmingly get in through phishing. Train2Secure runs realistic phishing simulations and short training that teach your team to spot the lure.