78% of enterprise servers are reachable over SMB or WinRM, administrative protocols commonly exploited for ransomware spread and lateral movement.

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

50% of organizations reported ransomware intrusions, down from 54% in 2025.

80% of enterprise servers are reachable from anywhere inside the network, creating greenfield conditions for ransomware, operational disruption, and full-environment compromise.

In September 2025, Qilin's compromise of a single South Korean MSP affected 32 financial institutions and resulted in over 2 terabytes of stolen data.

Reported ransomware incidents targeting finance increased 30% from 2024 to 2025.

Direct ransomware attacks on financial institutions spiked 76% year-over-year in Q1 2026.

Banks reported 71 ransomware disclosures in 2023 compared to 44 disclosures by investment firms, while by 2025 banks fell to 36 disclosures and investment firms rose to 84 disclosures (41.6% of all incidents).

Qilin was responsible for 59 finance-sector incidents in the past year.

23% of Nordic CISOs cited ransomware or availability disruption as their primary concern.

There were 264 publicly disclosed ransomware attacks in Q1 2026, a 15% decrease year-on-year.

Among undisclosed ransomware attacks in Q1 2026, Qilin led with 339 attacks (16%), The Gentlemen 200 attacks (9%), and Akira 190 attacks (9%).

There were 2,160 undisclosed ransomware attacks identified in Q1 2026.

Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.

Ransomware payouts now average $40 million, nearly triple their level in 2024.

Only one in nine global ransomware attacks were publicly disclosed in Q1 2026.

The Gentlemen claimed 273 attacks since its emergence in 2025 through the end of Q1 2026.

79 ransomware groups claimed victims during Q1 2026.

Undisclosed ransomware attacks increased by 2% year-on-year.

Data exfiltration occured in 96% of ransomware attacks in Q1 2026.