Ransomware Attacks Increased 20% in H1 2026

Ransomware attacks saw a 20% year-over-year increase in the first half of 2026, with a total of 5,275 recorded incidents, according to a new report from NordStellar. The second quarter of 2026 alone recorded 2,581 ransomware incidents. While the number of attacks decreased by 4% in the second quarter compared to the first three months of the year, cybersecurity experts caution against complacency, noting a new baseline of approximately 2,500 attacks per quarter.

Two competing ransomware-as-a-service groups, Qilin and The Gentlemen, are significantly contributing to the rise in attacks. Qilin, active since at least 2022, has targeted organizations including the healthcare group Synnovis and the Cleveland Municipal Court. The Gentlemen, formed by former Qilin members in 2025, has demonstrated rapid expansion, impacting hundreds of organizations across more than 66 countries and 20 industries. In the second quarter of 2026, The Gentlemen was responsible for 284 attacks, while Qilin was attributed 299 attacks, a 39% increase from the previous year.

The growing influence of these two groups suggests a maturing and stabilizing ransomware ecosystem, which could lead to increased danger. NordStellar highlights that established ransomware groups possess refined tools, affiliate networks, and negotiation infrastructures, making them more sophisticated and potentially more impactful. This trend indicates a shift towards more professionalized and persistent cyber threats, requiring continued vigilance from businesses and individuals.