Ransomware climbed to a second straight 2026 high of 1,073 attacks in August
NCC Group counted 1,073 ransomware attacks in August, a second straight 2026 high and 12% above July. Industrial companies took 31% of them, up from 28% in July, so the hardest-hit sector drew a larger slice of a larger total.
The Watch · Security desk
What happened
- Qilin was linked to 164 of August's attacks, which put it ahead of The Gentlemen at 116 and made it the most active group of the month.
- North America took 44% of the attacks and Europe 26%, the same concentration in Western regions that NCC reported in earlier months.
- NCC's incident responders worked an August case at a transportation company where the Aurora group left a short ransom note on an encrypted hypervisor.
- According to NCC's report, an intrusion at Boston Scientific disrupted the company's manufacturing, shipping and customer order processing worldwide.
Why it matters
- What doesn't add up contradiction NCC and Infosecurity give different July totals, so anyone tracking month-on-month growth has two baselines, and only NCC's 960 produces the published 12%.
- Who's exposed exposure On NCC's own rounded shares, industrial operators took a larger part of August's growth than their share of the total would suggest.
- What it sets up precedent Qilin and The Gentlemen have swapped the top spot several times this year, so another swap is likely and Qilin moving ahead says little about whether the threat is growing.
- Who has to decide decision NCC's own casework points defensive spending at exposed VPNs and at recovering encrypted hypervisors, however much weight Hull's AI explanation deserves.
Next story · Security · Oct 9
Japan extradites an alleged Qilin core member to Germany after he arrived as a touristConfirmed5 publishers
The 12% figure only works from NCC's own baseline. The release puts July at 960 attacks, which was itself the year's high at the time [16]. Against 960, August's 1,073 is an 11.8% rise [19]. Infosecurity Magazine covered the report after its September 23 publication [2] and gave July as 973 [17]. On that base the rise is 10.3% [20]. Either base leaves two record months in a row, July and August, and that is as far as the figures in hand go. Matt Hull, NCC's vice president of cyber intelligence and response, reads a trend into them. "August was the second consecutive month of highest ransomware levels for the year, indicating a steady rise in global activity," he said [3].
Industrial companies took more of the growth than their share suggests. The sector had 28% of July's 960 attacks and 31% of August's 1,073. That is roughly 269 attacks rising to roughly 333, an increase of about 24% [14]. Because the shares are rounded, the true rise is somewhere between about 20% and 28%. Even the low end is well above the overall 12% [14]. NCC called the higher share "a signal of the growing target on critical infrastructure organisations as threat actors look to cause mass disruption" [22].
Qilin's count comes to 15.3% of the month [13]. That matches the 15% NCC gave when it said Qilin had overtaken The Gentlemen [4]. Infosecurity reported that the two groups have regularly traded places as the most prolific actor of 2026 [6]. Clop was third with 89 attacks, and Dire Wolf and INC Ransom had 43 each [10]. Those five groups account for 455 attacks, about 42% of the total. The other 618 belong to smaller groups or could not be linked to a known actor [15].
Aurora is the one group the release profiles from NCC's own incident work. It first appeared this year. It has hit organisations in manufacturing, legal, and research and development, and it has broken in by exploiting VPNs, "a technique already common" in NCC's words [11]. In the transportation case, the ransom note told the victim to get in touch through the Tor browser at a supplied .onion link, using the organisation's access key [12]. NCC did not name the VPN products or the vulnerabilities Aurora used. The firm wrote that "data extortion is now also a priority end goal, alongside encryption and, in some cases, destruction" [9].
Hull puts the rise down to AI and geopolitics. "A combination of factors is driving this increase including rapid advancements in AI and ongoing geopolitical volatility which are fuelling state-sponsored threats," he said [21]. The same release calls Aurora's methods "nothing new" [9].
What to watch
- NCC's September report: a third record month in a row would lengthen the run, while a drop would make July and August look like a peak.
- Publication of the VPN products or CVEs Aurora exploits, which would give defenders something specific to patch.
- Whether The Gentlemen take the top spot back from Qilin in September, as the two groups have done repeatedly this year according to Infosecurity.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
NCC Group recorded 1,073 ransomware attacks in August 2026, the highest monthly total of 2026.
- [2]
NCC Group's Cyber Threat Intelligence Report for August 2026 was published on September 23.
- [3]
"August was the second consecutive month of highest ransomware levels for the year, indicating a steady rise in global activity."
- [4]
Qilin overtook The Gentlemen as the most dominant threat group, responsible for 15% of all attacks in August.
- [5]
Of attacks linked to a known threat actor, 164 were attributed to Qilin and 116 to The Gentlemen.
- [6]
Qilin and The Gentlemen have regularly traded places as the most prolific threat actor behind incidents during 2026.
- [7]
In line with previous months, North America was the most targeted region with 44% of attacks, followed by Europe with 26%.
- [8]
The industrials sector experienced 31% of all ransomware attacks in August, up from 28% in July.
- [9]
"These techniques are nothing new, but data extortion is now also a priority end goal, alongside encryption and, in some cases, destruction."
- [10]
Other prolific groups in August were Clop (89 attributions), Dire Wolf (43) and INC Ransom (43).
- [11]
Aurora, a RaaS actor that first emerged in 2026, has targeted organisations in manufacturing, legal, and research and development, and has conducted successful attacks by exploiting VPNs, "a technique already common".
- [12]
NCC's Digital Forensics and Incident Response team observed Aurora on an August case at a transportation-sector organisation, where it left a short ransom note on the encrypted hypervisor directing the victim to make contact via the Tor browser at a provided .onion link with the organisation's access key.
- [13]
Qilin's 164 attributed attacks are 15.3% of August's 1,073.
- [14]
Industrial-sector attacks rose from roughly 269 in July to roughly 333 in August, about 24%. Allowing for whole-percent rounding of the shares, the rise is between about 20% and 28%, above the overall 12%.
- [15]
The five named groups (Qilin, The Gentlemen, Clop, Dire Wolf, INC Ransom) account for 455 of 1,073 attacks, about 42%, leaving 618 with other groups or no known attribution.
- [16]
August's total was a 12% increase from 960 attacks in July, which had itself seen the highest monthly figures of the year to date.
- [17]
Infosecurity Magazine reported the 12% increase as being on 973 organizations hit by ransomware in July.
- [18]
Boston Scientific experienced an intrusion into multiple IT systems that led to global disruption of its manufacturing, shipping and customer order processing.
- [19]
Measured against NCC's July figure of 960, August's 1,073 attacks is an 11.8% rise.
- [20]
Measured against Infosecurity's July figure of 973, August's 1,073 attacks is a 10.3% rise.
- [21]
"A combination of factors is driving this increase including rapid advancements in AI and ongoing geopolitical volatility which are fuelling state-sponsored threats."
- [22]
NCC described the rise in the industrial share as "a signal of the growing target on critical infrastructure organisations as threat actors look to cause mass disruption."
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comRansomware Attacks Reach Record High for 2026 - Infosecurity Magazine
2 articles · September 23, 2026
- NCC Group Monthly Threat Pulse – Review of August | NCC Group
nccgroup.com
1 article
Topics and entities
Entities
- Aurora ransomware group
- Clop
- Qilin
- The Gentlemen
- NCC Group
- Boston Scientific
- Infosecurity Magazine