Ransomware Attacks Rise 50% in Q3, Says NordLayer

Ransomware attacks are up more than 50% year-over-year, setting an all-time high for one network security company.

NordLayer Intelligence, a threat exposure management platform, said it recorded 2,894 attacks in the third quarter 2026. There were 1,933 ransomware attacks in Q3 2025.

The number of attacks in Q3 is also up 8.6% from Q2 2026.

Vakaris Noreika, cybersecurity expert at NordLayer Intelligence, said the third quarter indicates a stabilization in the ransomware market, which had been rebuilding after the takedown of the LockBit group, BlackCat and RansomHub.

Related: Two Russian Men Plead Guilty in LockBit Ransomware Attacks

“The numbers we see today are merely the first stepping stone in ransomware’s new era,” said Noreika in a statement. “The market has found its footing. Going forward, it’s likely that even more new players will emerge, and attack numbers will continue to climb.”

New groups such as The Gentlemen and Qilin have emerged, accounting for nearly 750 ransomware attacks in Q3, said NordLayer.

Small and medium-sized businesses (SMBs) with up to 200 employees and under $25 million in revenue, operating in the manufacturing sector, remain the most targeted by ransomware attacks. NordLayer expends the trend to continue, with North America leading as the victim of almost half of the attacks.

NordLayer also notes ransomware groups are often skipping encryption and just stealing data.

“Stealing data is faster and simpler, so one group can hit many victims at once with far less effort,” added Mantas Sabeckis, cybersecurity expert at Nord Security.

Topics Cyber