Executive Summary  

In April 2026, ransomware activity recorded a total of 867 victims globally, marking a continued elevation in incident volume against the backdrop of an already heightened threat environment that has trended upward since Q4 2025. While the month-over-month trajectory reflects a broadly sustained operational tempo, the ransomware-as-a-service (RaaS) ecosystem demonstrated notable structural shifts, with geographic diversification expanding and new mid-tier operators consolidating their presence.  

The United States retained its position as the most impacted geography, accounting for 324 victims. Business Services emerged as the most heavily targeted confirmed sector with 175 victims, representing a significant shift from prior months where Manufacturing and Technology competed for the top position. Manufacturing (125 victims) and Consumer Services (80 victims) followed as primary targets.   

Qilin maintained its dominant position as the leading threat actor for a fourth consecutive month, underscoring the group's sustained operational consistency. The RaaS ecosystem continued to expand in group count and geographic reach, with victim organizations identified across more than 80 countries.  

Introduction  

This report provides an in-depth assessment of ransomware victim distribution by sector and geography during April 2026, including a comparative analysis with March 2026 to identify shifts in threat actor activity, sector targeting patterns, geographic impact, and overall victim volume. The findings are intended to support cybersecurity leaders and response teams in strengthening defensive posture and operational preparedness.  

Key Points  

Ransomware Activity — April 2026  

Ransomware activity in April 2026 demonstrated continued and expansive global reach, with victim distribution heavily concentrated in North America and Western Europe while showing measurable growth across Asia-Pacific, Latin America, and the Middle East.  

The United Kingdom (56 victims) recorded a significant increase from March, reinforcing sustained pressure on British organizations particularly in professional and financial services. Germany (50 victims) maintained substantial exposure within Western Europe. France (30 victims), Italy (26 victims), and Canada (22 victims) also experienced notable targeting.  

In the Asia-Pacific region, Australia (20 victims) and Japan (13 victims) sustained consistent exposure, while Thailand (16 victims), Taiwan (9 victims), Singapore (9 victims), and Hong Kong (9 victims) reflected continued growth in regional ransomware activity. India (10 victims) maintained its position as a primary Asia-Pacific target.  

In Latin America, Brazil (14 victims) and Mexico (15 victims) led regional activity, with Colombia (7 victims) and Argentina (6 victims) also recording incidents. In the Middle East, United Arab Emirates (4 victims) and Saudi Arabia (3 victims) maintained consistent exposure.  

Notably, in April researches identified victims across more than 80 countries, including a substantial number of new or previously lower-volume geographies across Africa, Southeast Asia, Eastern Europe, and the Caribbean. A total of 37 incidents were attributed to "Other/Not Found," reflecting residual incomplete geographic attribution in public leak disclosures.  

Threat actors continued to prioritize regions with advanced digital infrastructure, higher ransom payment capacity, and mature enterprise environments, while simultaneously demonstrating increased opportunistic targeting across emerging markets.  

Major Ransomware Breaches Across Global Sectors — April 2026  

During April 2026, ransomware and cyber-extortion activity produced a number of significant confirmed or claimed incidents across critical industries and regions.  

Technology and Media — North America  

ShinyHunters claimed one of the month's most prominent breaches against Rockstar Games, the developer behind the Grand Theft Auto franchise. The group did not breach Rockstar's systems directly; instead, it exploited authentication tokens extracted from Anodot, a third-party cloud monitoring service provider, to access Rockstar's Snowflake cloud data warehouse instances. The attack chain was effectively invisible to Rockstar's security team, as access originated through a trusted integration using valid credentials. ShinyHunters issued a ransom deadline of April 14, 2026, threatening to leak stolen data if demands were not met. Rockstar confirmed that "a limited amount of non-material company information" was accessed via the third-party breach, stating there was no impact on operations or players. The incident is part of a broader ShinyHunters campaign systematically exploiting SaaS integration trust chains across dozens of organizations through the same Anodot entry point.  

Education and E-Learning — United States

ShinyHunters claimed responsibility for a breach at Udemy, one of the world's largest online learning platforms, listing the company on its dark web leak site on April 24, 2026, with a ransom deadline of April 27. The group claimed to have exfiltrated over 1.4 million records containing personally identifiable information — including names, physical addresses, phone numbers, employer information, and instructor payout details — and threatened to release the data if demands were not met. Following the expiry of the deadline, the stolen dataset was subsequently leaked publicly and was indexed by Have I Been Pwned on April 26, 2026. The incident is part of ShinyHunters' broader 2026 campaign exploiting SaaS platform integrations and Salesforce-linked infrastructure across dozens of organizations simultaneously.

Automotive Data and Analytics — Europe and Australia  

Autovista Group, a critical provider of data, analytics, and industry insights for the European automotive sector, confirmed a significant ransomware attack in early April 2026 that forced the company to disable several customer-facing platforms, effectively cutting off essential pricing and valuation data for the automotive supply chain. The UK-headquartered company, whose brands include Eurotax, Glass's, Rødboka, and Schwacke, engaged external cybersecurity experts to contain the attack, which disrupted operations across Europe and Australia. The incident disrupted vehicle valuation services for dealerships, insurers, and fleet management firms across the continent, and no threat actor had publicly claimed responsibility at time of reporting.  

Cloud Hosting and Developer Infrastructure — United States

Vercel, a widely used cloud application hosting and deployment platform, disclosed a confirmed security breach on April 19, 2026, originating from a supply chain compromise at Context.ai, a third-party AI productivity tool used by a Vercel employee. Attackers exploited OAuth tokens stolen via Lumma Stealer infostealer malware to take over the employee's Google Workspace account and pivot into Vercel's internal environments, where they bulk-extracted environment variables — including API keys, database credentials, and cloud access keys — from a limited subset of customer projects that were not encrypted at rest. A threat actor attempted to sell the stolen data on BreachForums, claiming it could be used to mount a large-scale downstream supply chain attack. Vercel confirmed the breach, engaged incident response experts including Mandiant, notified law enforcement, and subsequently identified additional customer accounts compromised prior to the April incident. Vercel's core infrastructure, Next.js, and Turbopack projects were confirmed unaffected.

Consumer Services and Entertainment — Global  

DragonForce claimed a 352.24 GB data theft from Australian ice-cream franchise Gelatissimo, with the company confirming unauthorized access to its network and launching an investigation. The stolen data allegedly included employee details, partial tax file numbers, financial records, and visa application data. This incident reflects continued attacker opportunism across consumer-facing organizations, with mid-sized retail and franchise brands increasingly drawn into the crosshairs of high-volume ransomware operators.  

Public Sector and Critical Infrastructure — Canada and Regional  

The Rural Municipality of Gimli in Canada was targeted by the Payload ransomware group, demonstrating continued attacker interest in government and public sector entities at the municipal level — a pattern consistent with broader observed trends of ransomware operators targeting local government bodies where IT resources and defensive posture are typically limited.   

These incidents collectively underscore ransomware groups' continued emphasis on supply chain exploitation, data exfiltration as the primary extortion lever, and the broadening of target profiles to include data-as-a-service providers whose disruption creates cascading downstream impact.  

Recommendations — April 2026 Ransomware Outlook  

To mitigate the ongoing and intensifying ransomware threat, organizations should continue strengthening defensive resilience through layered controls. The April incidents highlight several critical vectors requiring immediate attention, including third-party SaaS integration vulnerabilities, cloud token security, and supply chain dependencies.  

Conclusion  

The ransomware landscape in April 2026 reflected continued elevation in victim volumes against a sustained high baseline, with 867 globally recorded victims and activity spanning more than 80 countries. The United States remained disproportionately affected, while the United Kingdom, Germany, France, and Australia experienced notable targeting within their respective regions.  

Sectoral distribution in April marked a significant shift, with Business Services displacing Manufacturing from the top position for the first time in recent reporting cycles — a development consistent with observed attacker interest in professional services organizations holding high-value client data. Manufacturing, Consumer Services, Healthcare, and Technology continued to represent primary targets, with Education and Public Sector sustaining consistent secondary exposure.  

The emergence of APT73 as a high-volume operator, the continued growth of CoinbaseCartel's extortion-only model, and the persistence of ShinyHunters' supply chain exploitation campaigns collectively signal an ecosystem in active evolution — one where traditional encryption-based ransomware increasingly coexists with data-theft-only extortion models that require no malware deployment.  

Ransomware remains a persistent, adaptive, and strategically driven threat. The structural resilience of the RaaS ecosystem, the growing sophistication of supply chain and SaaS integration attacks, and the demonstrated willingness to target a broadening range of geographies and sectors underscore the need for sustained investment in detection, response, and recovery capabilities across all industries and organizational sizes.