Data exfiltration occured in 96% of ransomware attacks in Q1 2026.

The Gentlemen claimed 273 attacks since its emergence in 2025 through the end of Q1 2026.

Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.

There were 2,160 undisclosed ransomware attacks identified in Q1 2026.

There were 264 publicly disclosed ransomware attacks in Q1 2026, a 15% decrease year-on-year.

Only one in nine global ransomware attacks were publicly disclosed in Q1 2026.

64% of organizations experienced a ransomware attack in the past year.

Ransomware represented only 12% of claim volume among manufacturers despite accounting for the majority of incurred losses.

In 2025, the Qilin group was responsible for 12.8% of ransomware attacks.

There were 7,831 confirmed ransomware victims globally, a 389% year-over-year increase from approximately 1,600 victims previously.

72% of small businesses experienced fraud, scams, or ransomware last year.

68% of organisations have raised budgets for post-breach remediation and ransom payments.

Ransomware victims concentrate geographically with the U.S. at 3,381, Canada at 374, and Germany at 291.

The top three targeted sectors by ransomware victims were manufacturing (1,284), business services (824), and retail (682).

The ransom payment rate in healthcare is 68%–72% compared with about 40% in other sectors.

59% of cyberattacks on healthcare organizations involve ransomware.

Among organizations hit by ransomware where operations or data were affected, only 28% fully recovered all affected data.

51% of observed ransomware victims in Q1 2026 were based in the United States; the United Kingdom and Canada each accounted for 4%.

The construction industry experienced 131 ransomware victims in Q1 2026, a 44% year-over-year increase.

The Gentlemen ransomware group increased from 35 victims in Q4 2025 to 182 victims in Q1 2026.