Comparitech’s Q3 2026 ransomware roundup, updated 7 October 2026 and picked up by KnowBe4 on 21 October, reports the highest quarterly attack count the publisher has recorded. All figures below come from the Comparitech report unless stated otherwise. We have not independently checked the underlying counts.
The headline numbers
Comparitech counts 2,627 attacks in Q3 2026, about 29 per day. That compares with 2,030 in Q2 2026 (up 29%) and 1,636 in Q3 2025 (up 61%).
Read the method before the number
Comparitech separates attacks into two groups:
- Confirmed (247): the victim disclosed a ransomware attack, or acknowledged a cyber attack matching a group’s claim.
- Unconfirmed (2,380): a group claimed the attack and the victim never acknowledged it. Comparitech notes the claim may be false, or the victim may simply not have disclosed it.
So roughly nine in ten entries rest on a leak-site claim alone. Comparitech also says claims often surface weeks or months after the attack, so quarter-to-quarter figures can shift and attacks may be attributed to different periods. Our assessment: treat the totals as a measure of claimed extortion activity, not of verified incidents.
Groups
Comparitech reports:
| Group | Q3 2026 claims | Change vs Q2 |
|---|---|---|
| Qilin | 357 (27 confirmed) | +24% |
| The Gentlemen | 342 (26 confirmed) | +29% |
| Clop | 48 | up from 1 (+4,700%) |
| DireWolf | not given in the pages we read | +1,450% |
| Rhysida | not given in the pages we read | +200% |
| Akira | not given in the pages we read | -23% |
| LockBit | not given in the pages we read | -51% |
Clop’s percentage looks dramatic because the base was a single Q2 claim. Compare our coverage of Clop’s Windchill campaign, Qilin and The Gentlemen. Rhysida, which the report notes is one of the few groups that publishes its demands, is profiled here.
Sectors
Q2 to Q3 increases, per Comparitech: education +50% (50 to 75), healthcare +39% (135 to 188), government +36% (91 to 124) and business +27% (1,753 to 2,234). Year on year, healthcare roughly doubled (93 to 188, +102%) and government rose 80% (69 to 124).
Within business, finance rose 72% (116 to 199) and technology 70% (154 to 262). Manufacturing was the most-targeted business category at 478 attacks. Legal firms fell 26%. The report does not say why.
Countries
The US had 1,066 attacks (41%, up 34%). Germany was second with 121, then Canada (103), Italy (86) and India (80, up from 37). Argentina rose from 18 to 45.
Ransom data is thin
Comparitech cautions that ransom figures are rarely disclosed. Within that limit, it reports:
- Overall median demand $150,000; average $602,400.
- Median demands: government $60,000, healthcare $300,000, education $510,000, business $100,000.
- Largest disclosed demand: $12.3M from Everest against Stadler Rail, which refused to pay (201 GB reportedly leaked).
- Rhysida’s $2.3M demand against the Government of Berlin, which Berlin refused. Rhysida claimed 5.79 TB stolen.
Comparitech states no government, healthcare or education victim was confirmed to have paid. Nick Scali (Australia) is rumoured to have negotiated, with no payment confirmed.
Data exposure
Confirmed attacks compromised 1,611,971 records, and Comparitech says over 641 TB was stolen across all attacks. Its largest disclosed breaches: Saber Healthcare Group (US, 427,084), Arbeiterkammer (Austria, 270,000, claimed by The Gentlemen), Greenberg Traurig (US, 150,000, claimed by Silent Ransom Group), Ryomo Systems (Japan, 127,789, claimed by SafePay) and AngMar Management Services (US, 126,196, claimed by Interlock).
Our assessment
- The direction is consistent with other trackers. A search-result snippet attributes to Bitdefender 790 claimed victims in September 2026 and to Check Point a 53% year-on-year rise; we did not open those sources, so treat both as unverified.
- The healthcare and government growth matters most for defenders, since those sectors report the lowest payment rates in this dataset and so are likelier to face data leaks than quiet settlements.
- Group rankings depend on leak-site volume. A high-volume affiliate programme can top the table without having the most damaging intrusions; the confirmed counts (27 and 26) are a better guide to verified impact.