State of Ransomware: March 2026
Published 1 April 2026 · ThreatVectr Intelligence
Ransomware groups claimed 800 attacks on organisations worldwide in March 2026, up 2% on the previous month's 781. 50 distinct groups posted at least one victim during the month, across 76 countries. The busiest single day was 3 March, with 40 victims listed.
Qilin was the most active operation of the month, claiming 140 victims — 18% of all listings. NightSpire (66) and The Gentlemen (58) followed. 4 groups appeared for the first time, including Krybit, Lapsus$, Exitium, Cry0.
Manufacturing bore the heaviest targeting, with 107 claimed victims, ahead of Business Services (99) and Technology (97). By geography, United States accounted for 349 claims — 44% of the month — with France (38) and United Kingdom (32) next.
Claims per day — March 2026
Most active groups
- 1Qilin·14018%
- 2NightSpire4668%
- 3The Gentlemen1587%
- 4DragonForce4567%
- 5INC Ransom2537%
- 6LockBit3537%
- 7Akira3486%
- 8Handala33395%
- 9Coinbasecartel6334%
- 10Play5233%
First seen this month:Krybit, Lapsus$, Exitium, Cry0
Most-targeted sectors
- 1Manufacturing107
- 2Business Services99
- 3Technology97
- 4Healthcare68
- 5Financial Services51
- 6Construction50
- 7Consumer Services44
- 8Public Sector34
- 9Education32
- 10Transportation/Logistics28
Most-affected countries
- 1United States349
- 2France38
- 3United Kingdom32
- 4Italy24
- 5Germany22
- 6Canada19
- 7Brazil16
- 8Spain16
- 9Israel16
- 10India13
Every figure in this report counts a claim posted to a criminal leak site, observed via the monitoring service ransomware.live. A listing is an extortion tactic, not a confirmed breach: some claims are exaggerated, some are duplicates under new branding, and a few are outright false. Companies named in listings have not necessarily confirmed any incident, and ThreatVectr does not publish victim names from this dataset.
Cite this report
This report is free to cite and reproduce with attribution. Suggested citation:
ThreatVectr, “State of Ransomware: March 2026”, https://threatvectr.com/ransomware-tracker/reports/march-2026
Journalists and researchers: for questions about the data or methodology, contact the newsdesk.
Most ransomware starts with one email
The groups in this report overwhelmingly get in through phishing. Train2Secure runs realistic phishing simulations and short training that teach your team to spot the lure.