Global ransomware activity hit an all-time high in August 2026, with 997 attacks recorded worldwide, according to new research from Comparitech published on 14 September. The monthly total averages 32 attacks per day and represents a 23 percent increase from 809 attacks in July, surpassing the previous record of 988 attacks set in February 2025. ## Businesses and Critical Services Under Pressure Businesses accounted for 861 of the August attacks, a 24 percent rise from 692 in July, with 49 attacks confirmed so far. Healthcare providers saw incidents climb 30 percent, from 53 to 69, with eight confirmed. Among them, Nutex Health Inc. disclosed unauthorized activity in a SEC filing on 24 August in an attack claimed by The Gentlemen, while Cedar County Memorial Hospital suffered IT disruption from 14 to 28 August in an attack claimed by Wallstreet. The sharpest sectoral increase came at utility companies, where attacks doubled from five in July to 10 in August. Italy's water company Alto Calore Servizi confirmed an attack later claimed by the Titan group, the second time the company has been hit after a Medusa ransom demand in 2023. "The healthcare sector saw a 30 percent increase in attacks, but utility companies saw the biggest spike," said Rebecca Moody, head of data research at Comparitech. "Here, attacks doubled, rising from five in July to 10 in August. Law firms (up 52%), tech companies (up 42%), and finance companies (up 40%) also saw significant increases." Only two sectors bucked the trend: education, down 4 percent, and food and beverage, down 5 percent, were the only areas to see ransomware attacks decrease. ## Qilin Leads a Crowded Field The Qilin and The Gentlemen groups together accounted for more than 26 percent of August's attacks. Qilin claimed 157 incidents, its claims rising 22 percent during the month, while The Gentlemen claimed 107, a 21 percent decline. Clop recorded the largest jump in claims, adding 45 victims to its leak site compared with one in July, with the attacks linked to exploitation of the PTC Windchill vulnerability. Government entities saw little change, with 39 attacks recorded against 38 in July, 18 of them now confirmed. Nine confirmed attacks struck US municipalities, including Coweta in Oklahoma and Circleville in Ohio, both of which refused demands. In Germany, the Rhysida group issued the government of Berlin with a 30 bitcoin demand, about 2.3 million dollars, for the deletion of 5.79 TB of data. Berlin refused. ## Geography of the Surge The United States recorded a 28 percent increase in attacks, which Moody attributes largely to Qilin, with 34 percent of the group's claims aimed at US companies. Italy and Taiwan saw the steepest climbs, each rising 200 percent: Italy from 16 attacks in July to 48 in August, Taiwan from 7 to 21. The UK rose 44 percent and Germany 14 percent, while attacks fell 3 percent in Canada and 20 percent in India. From January to August 2026, 270 attacks on government entities have been recorded, nearly level with the 267 noted in the same period of 2025, and 124 attacks have been confirmed overall so far this year.