The State of Ransomware Q1 2026

Ransomware attacks show no signs of slowing down. In Q1 2026 alone, over 2,200 victims were claimed by ransomware and extortion groups globally, highlighting the continued scale and impact of the threat landscape.

In The State of Ransomware Q1 2026, we explore the latest ransomware trends, emerging threat groups and the tactics organisations need to prepare for now.

Key findings include:

• 2,262 ransomware victims recorded across Q1 2026
• Qilin emerged as the most active ransomware group, claiming 360 victims
• The United States accounted for 45.4% of all recorded victims
• Manufacturing was the hardest-hit sector, representing 14.6% of attacks
• 78 active ransomware and extortion groups identified across 99 affected countries