Ransomware attacks have increased dramatically during the second quarter of 2026, with undisclosed incidents surging 40% year-on-year, according to BlackFog's latest State of Ransomware Report. The cybersecurity firm documented 2,027 undisclosed attacks in Q2 2026, compared with 1,446 during the same period in 2025. The report, which provides comprehensive analysis of both publicly disclosed and undisclosed ransomware attacks worldwide, also recorded 306 publicly disclosed attacks during the quarter, representing a 16% increase compared to Q1 2026.[1]
Perhaps most concerning is the finding that 97% of all incidents involved data exfiltration, the highest rate ever recorded. This represents a shift in ransomware tactics, with criminals increasingly stealing sensitive information before encrypting systems, enabling them to threaten victims with public data leaks even if backups exist. The highest ransom demand during the quarter reached £25 million, reflecting the growing boldness of cybercriminal operations and the increasingly valuable nature of stolen corporate data.
Healthcare emerged as the most targeted sector, suffering 81 attacks and accounting for 26% of all disclosed incidents. The continued focus on healthcare organizations raises concerns given the potential impact on patient care and the sensitive nature of medical records. The services sector experienced 45 attacks (15%), marking a dramatic 221% increase compared to Q1 2026. This sharp rise suggests cybercriminals are increasingly focusing on service providers, potentially as a means of accessing multiple clients through a single breach. Government institutions recorded 30 attacks (10%), highlighting ongoing threats to public sector infrastructure and citizen data.
The United States remained the primary target for ransomware attacks, accounting for 169 disclosed incidents or 55% of the total. Australia experienced the second-highest number of attacks with 54 incidents, representing 18% of disclosed attacks globally.
The report identified 57 different ransomware variants associated with disclosed attacks, representing a 21% increase from Q1 2026. This proliferation of variants demonstrates the expanding ransomware ecosystem and the challenges facing cybersecurity professionals attempting to defend against multiple threat actors employing different techniques.
The findings paint a troubling picture of an escalating ransomware threat landscape. The 40% year-on-year increase in undisclosed attacks suggests many organizations are choosing to pay ransoms quietly rather than report incidents publicly, potentially due to concerns about reputational damage or regulatory consequences.
The near-universal rate of data exfiltration means that traditional backup strategies alone are insufficient protection. Organizations must now assume that attackers will steal data before encrypting systems, requiring enhanced monitoring of data movements and stricter access controls.
The dramatic increase in attacks targeting the services sector may indicate a shift towards supply chain attacks, where criminals compromise service providers to gain access to multiple downstream targets simultaneously. As ransomware groups continue to refine their techniques and expand their operations, the second quarter statistics suggest the threat shows no signs of diminishing. The combination of increasing attack volumes, higher exfiltration rates, and growing variant diversity presents significant challenges for organizations across all sectors.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/ransomware-attacks-surge-40-as-data-theft-hits-record-high-9601.html
Comments