CYBERSECURITY — Global ransomware activity reached a new high for 2026 in August, according to security research published by NCC Group. The company recorded 1,073 ransomware incidents during the month, a 12% increase from the 960 incidents reported in July.

The latest figures point to a persistent challenge for businesses: ransomware remains a serious operational risk even as the groups responsible for attacks change positions in threat rankings. NCC Group identified Qilin as the leading ransomware operation in its August observations, accounting for approximately 15% of recorded attacks.

The findings also highlight the importance of looking beyond the names of prominent cybercriminal groups. For organizations, the more useful questions concern how attackers gain access, how far they can move through a network, and whether critical systems can be restored after an incident.

Ransomware Activity Reaches a New 2026 High

NCC Group's August 2026 Monthly Threat Pulse report recorded 1,073 ransomware incidents, up from 960 in July. The increase represents approximately 12% month over month.

The figures indicate that publicly observed ransomware activity continued to rise during the summer. However, the numbers should be interpreted carefully: incident totals from security researchers reflect the activity they identify and monitor, rather than a complete count of every ransomware attack worldwide.

Some attacks may never become public, while others may be disclosed after the original incident. Differences in monitoring methods can also affect how researchers classify and count activity.

For that reason, the NCC Group figures are useful for identifying trends within its reporting methodology, but they should not be treated as a definitive measure of every organization's exposure to ransomware.

Qilin Leads the August Ranking

One of the most notable findings in the report is Qilin's position at the top of the observed ransomware landscape. NCC Group attributed approximately 15% of August's recorded attacks to the group, which overtook The Gentlemen in its monthly ranking.

This change illustrates how quickly the ransomware landscape can shift. A group that dominates one reporting period may lose its position in the next as other operations expand, change tactics, or attract more affiliates.

It also demonstrates why businesses should avoid basing their security strategies solely on the reputation of a particular ransomware brand. Monitoring the techniques used to gain access, steal data, and disrupt systems is often more useful than focusing exclusively on which group currently appears most frequently in incident reports.

Industrial Organizations Remain a Major Target

The industrials sector accounted for 329 recorded incidents in August, representing approximately 31% of the total reported by NCC Group. Consumer discretionary businesses followed with 185 incidents, or around 17%.

These figures matter because an attack against an industrial organization can affect more than its office computers. Depending on the systems involved, a successful intrusion may disrupt manufacturing, shipping, customer orders, or other essential business processes.

However, sector-level statistics do not mean that every industrial company faces the same level of risk. Exposure depends on factors such as internet-facing systems, access controls, network architecture, software maintenance, and the organization's ability to detect and contain intrusions.

For companies operating in manufacturing and other industrial environments, security planning should account for both conventional IT systems and the operational technology that supports physical processes.

North America and Europe Account for Most Recorded Incidents

NCC Group reported 473 ransomware incidents in North America during August, accounting for approximately 44% of its observed total. Europe followed with 276 incidents, or around 26%.

These figures show that the two regions accounted for roughly 70% of the activity recorded in the report. They should not, however, be interpreted as direct estimates of the probability that a particular company in either region will be attacked.

For businesses in Asia, including Indonesia, global reporting remains useful for understanding attacker activity and defensive priorities. Local risk assessments should also consider regional incident reporting, the organization's industry, and its own exposure to external threats.

Why Ransomware Rankings Do Not Tell the Whole Story

Cybersecurity headlines often focus on the groups responsible for the largest number of reported attacks. That information can help identify active threats, but it provides only one view of the problem.

Ransomware operations can involve developers, infrastructure operators, and affiliates who carry out intrusions. In a ransomware-as-a-service model, different participants may perform separate roles within a broader criminal operation.

This structure can make the threat landscape difficult to track. Groups may change names, cease public activity, or be replaced by other operations, while individual actors and attack techniques may continue to appear elsewhere.

Nevertheless, similarities in tactics do not automatically prove that two groups share the same members or leadership. Claims that a newer operation is a direct offshoot of another group should be supported by specific threat-intelligence evidence rather than assumptions based on branding or technical similarities.

SHP News Analysis: What the Numbers Mean for Businesses

The 12% monthly increase is an important indicator of the ransomware activity observed by NCC Group. But the number alone does not establish that every business became 12% more likely to be attacked.

A more useful approach is to translate threat intelligence into questions about an organization's own security posture. Are important systems exposed to the internet? Can attackers compromise privileged accounts? Could an intrusion spread from one workstation to critical infrastructure? Would backups remain available if production systems were encrypted?

These questions lead to practical decisions that businesses can make regardless of which ransomware group currently tops the rankings.

They also provide a more meaningful basis for prioritizing security investments than simply reacting to the latest threat headline. A company with weak access controls and untested backups may face serious consequences even if the attacker is not among the most frequently reported groups.

Six Defensive Priorities for Reducing Ransomware Risk

• Strengthen authentication: Use multifactor authentication for privileged accounts, remote access, and other critical entry points.
• Patch exposed systems: Prioritize internet-facing services and vulnerabilities known to be exploited in real-world attacks.
• Segment networks: Restrict unnecessary communication between systems so that a compromised device cannot easily provide access to an entire organization.
• Protect and test backups: Maintain isolated or otherwise protected backups and regularly test whether critical data and services can actually be restored.
• Monitor suspicious activity: Investigate unusual account access, unexpected remote connections, and other signs of possible compromise.
• Prepare an incident response plan: Define how to isolate affected systems, preserve evidence, coordinate response teams, and restore operations.

No single measure can eliminate ransomware risk. Effective protection combines preventive controls, monitoring, containment, and recovery planning so that one security failure does not automatically become a business-wide crisis.

Conclusion

NCC Group's August 2026 report recorded 1,073 ransomware incidents, the highest monthly total in its 2026 reporting to that point. Qilin led the observed group ranking, while industrial organizations remained the most frequently affected sector.

The findings highlight the continuing importance of ransomware preparedness, but they also demonstrate why threat intelligence needs context. Group rankings can change quickly, and reported incident totals represent observed activity rather than every attack taking place worldwide.

For businesses, the most valuable response is not simply to follow the latest ransomware group. It is to strengthen access controls, limit the spread of intrusions, detect suspicious activity, and ensure that critical operations can recover when defenses fail.

Sources and References

• Primary source: NCC Group — Monthly Threat Pulse: Review of August 2026.
• Previous monthly report: NCC Group — Monthly Threat Pulse: Review of July 2026.
• Additional context: TechTarget — August's ransomware activity hit new high for the year.

Editorial note: Statistics in this article refer to incidents observed and reported by NCC Group. They are not a comprehensive count of all ransomware attacks worldwide. SHP News' analysis and defensive recommendations are editorial context, distinct from the source's reported findings.