Ransomware Attacks Rose 25% in a Year. Artificial Intelligence Isn't the Main Driver.

Key points

• Security firm Black Kite recorded 7,551 confirmed ransomware victims worldwide between April 2025 and March 2026, a 25% rise on the prior year.
• Victim numbers jumped 60% in the second half of that period, from 2,904 in April-September 2025 to 4,647 in October 2025-March 2026.
• March 2026 was the single busiest month on record, with 861 organisations hit, roughly 28 per day.
• More than 60 new criminal groups entered the ransomware market during the study window; Black Kite counts 146 active groups as of March 2026.
• Over 90% of victims showed measurable, externally visible security weaknesses just before they were attacked.

Ransomware, malicious software that locks a business's files and demands payment to restore them, isn't just a persistent problem. It's getting faster and wider.

That's the headline finding from Black Kite's annual ransomware report, covering April 2025 through March 2026. The company monitors public breach disclosures and victim lists posted by criminal gangs, and counted 7,551 known victims across that twelve-month span. March 2026 alone accounted for 861 of them.

How did so many organisations get hit at once?

Two things happened together. The criminal market fragmented: more than 60 new ransomware groups started operating during the study period, lowering the average skill level required to run a campaign. Black Kite's chief research and intelligence officer, Ferhat Dikbiyik, puts it plainly: "The barrier to running one keeps getting lower."

Attackers also found a shortcut. Instead of targeting one company at a time, they broke into suppliers and IT service providers shared by many businesses. One compromise of a managed service provider, a company that handles IT systems on behalf of other businesses, let the group known as Qilin hit 32 South Korean financial institutions in a single campaign. Supply-chain incidents involving Oracle and Salesforce were cited as further examples of how one break-in ripples outward.

AI played a role, but a narrow one. Open-source tools lowered the cost of writing attack code and helped people with less technical skill enter the market. Dikbiyik told Dark Reading early signs of AI-assisted code had turned up inside some ransomware programs, though he's cautious about overstating it: "What I can say is the growth is human. AI just let more people show up at once." Our 13 July piece on how AI is widening the security gap between well-resourced and under-resourced organisations makes clear this dynamic has been building for a while.

Should you worry?

Manufacturing was the most targeted industry, with 1,660 victims. Professional and technical services came second at 1,389. Construction entered the top three for the first time. Nearly half of all victims (49.3%) were US-based, though European attacks grew faster.

Small businesses aren't safe by obscurity anymore. Much of the new volume fell on companies earning between one million and five million dollars a year, not just large enterprises.

The risk to ordinary people is indirect but real. When a hospital or a local manufacturer gets locked out of its systems, staff can't work, patients face delays, and personal data held on company servers can be stolen and sold.

Black Kite found more than 90% of victims had visible warning signs before the attack: exposed passwords, unpatched software, and open remote-access portals. Dikbiyik's advice after an incident is to treat recovery as ongoing work, with formal security reviews at the 30-day, 60-day, and 90-day marks. Patch what attackers are actually exploiting now, not whatever software carries the highest theoretical risk score.

The volume is real, the acceleration is real, and the entry bar keeps dropping. What's being oversold is AI as the cause. The engine here is a crowded criminal market chasing visible, unprepared targets.