Report
Popular
BCON COLLECTIVE
The State of Ransomware Q2 2026
Ransomware and extortion activity remained persistent throughout Q2 2026, with more than 2,200 victims publicly claimed by threat groups around the world. Despite increasing law enforcement pressure and disruption efforts, ransomware operators continued to target organisations across a wide range of sectors and geographies.
In The State of Ransomware Q2 2026, we analyse the latest ransomware trends, the most active threat groups, and the industries and regions most affected during the quarter.
Key findings include:
- 2,214 ransomware victims recorded across Q2 2026
- Qilin was the most active ransomware group, claiming 288 victims
- The top 10 ransomware and extortion groups accounted for 56% of all recorded victims
- The United States remained the most targeted country, representing 34.0% of victims
- 89 active ransomware and extortion groups identified during the quarter
- 106 countries and 14 industry sectors were impacted by ransomware activity
- Business Services was the most targeted sector, accounting for 19.3% of all victims
