GoKawiilRansomware victim claims hit 894 in July, a 2026 monthly high, NCC Group finds
NCC Group's July threat advisory reports a 22% month-over-month rise in ransomware activity, with 894 victim organization listings recorded across industrial, consumer services, technology, critical infrastructure, finance and healthcare sectors. The Gentlemen and Quilin topped the list of attributed groups, while the US accounted for 41% of incidents; notably, the month also saw the first fully agentic AI-driven ransomware attack chain and a breach at Ernst & Young claimed by ShinyHunters.
GoKawiil's interpretation of the reporting above, not reported fact.
A spike in listed victims doesn't necessarily mean more successful extortion; researchers caution that criminal groups sometimes inflate claims for reputational bragging rights, muddying threat intelligence. Still, the emergence of agentic AI in an actual attack chain signals a meaningful shift in automation capability for cybercriminals, raising the stakes for defenders across critical sectors.
- July 2026 set a year-to-date record with 894 ransomware victim listings, up 22% from June.
- The Gentlemen and Quilin led attribution rankings, with industrial and US-based targets most affected.
- Analysts warn some victim counts may be inflated by attacker bravado rather than confirmed breaches.
Samsung T7 Shield Portable SSD — With ransomware listings hitting yearly highs, an offline backup is the simplest defense you fully control. The T7 Shield is rugged, pocketable, and fast enough to make regular full-system backups painless — just unplug it when you're done so encryption attacks can't reach it.
See Samsung T7 Shield Portable SSD on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: zdnet.com — Charlie Osborne, 2026-08-26
Published there as: “July was the worst month for ransomware victim claims in 2026 - or was it?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.