Executive Summary 

In September 2026, ransomware activity recorded a total of 850 victims globally, a 27.0% decline from the record 1,165 victims reported in August 2026. This ends a two-month run of increases and is the first monthly decrease since June. The total is still above May (789) and June (707) and only 17 victims below April's 867, so the threat environment remains elevated. 

The United States retained its position as the most impacted geography with 269 victims, approximately 31.6% of all recorded incidents. Manufacturing remained the most heavily targeted confirmed sector for a second consecutive month with 147 victims, followed by Professional Services (99 victims) and Technology (95 victims). 

TheGentlemen reclaimed the top position with 105 victims, ahead of Qilin (74 victims), which fell by more than half from its August peak. Storm (37 victims) took third place. Several operators that drove August's surge, notably Clop and Orova, all but disappeared from the leaderboard. A new wave of lesser-known groups, including AuditTeam, Emperador, N0n, Panzer, and Vexy, filled the space. Victim organizations were identified across 91 countries and territories, and 80 distinct threat groups were active during the month. 

Key Points 

Ransomware Activity — September 2026 

Ransomware activity in September 2026 was defined by a return to a more concentrated leadership structure at the top of the ecosystem, a sharp unwinding of the August surge, and the arrival of a large number of lesser-known operators. 

TheGentlemen recorded 105 victims, retaking the top position after a one-month absence. The group's claims spanned healthcare, insurance, retail, transportation, and technology, including a hospital operator in the United States, an airline in Canada, and a South African insurer whose data was exposed through a third-party service provider. Qilin followed with 74 victims, a steep retreat from its August peak, though it remained the second most active operator. Storm (37 victims) held third place, sustaining the momentum it established in August, when it debuted a new ransomware payload. 

Akira (36 victims) and Krybit (34 victims) maintained steady upper-tier activity, with Akira rising modestly from August. SafePay (32 victims) was the standout acceleration story among established groups, nearly tripling its August count. AuditTeam (30 victims) appeared in the upper tier for the first time, followed by Incransom (29 victims), which continued as a persistent mid-to-upper-tier operator but moderated from August's 44. 

Emperador (23 victims) tied with Settra (23 victims) for ninth place. Emperador is a newly observed operation first seen in mid-August 2026 that has concentrated on organizations in the United States, Brazil, and Colombia, with victims including a major European appliance manufacturer and Brazil's federal tax authority. LockBit5 (19 victims) declined from 31 in August but maintained a meaningful presence. 

N0n, Panzer, and Vexy Ransomware (18 victims each), SilentRansomGroup (18 victims), MetaEncryptor (17 victims), and Wallstreet (16 victims) formed a dense and largely unfamiliar mid-tier. Panzer, whose leak portal was first observed in early August, operates a semi-open affiliate program with an 80/20 revenue split and advertises builds for Windows, Linux, VMware ESXi, and FreeBSD environments. DireWolf (17 victims), Play (14 victims), MedusaLocker (13 victims), BrainCipher, DragonForce, Everest, and Rhysida (12 victims each), and Lamashtu (10 victims) rounded out the groups with double-digit counts. 

Several August standouts receded sharply. Clop and Orova, which each posted 45 victims in August, fell to just 2 apiece. Dark Project fell from 25 victims to 5, and ShinyHunters fell from 19 to 7, though the group continued to be linked to high-profile extortion activity. CoinbaseCartel and L Group, which recorded 24 and 28 victims in August, did not register meaningful volumes in September. In total, 80 distinct groups were identified as active during September 2026, down from 85 in August but still reflecting a highly fragmented ecosystem. 

Ransomware Activity — Month Wise 2023-2026 

Compared with 2024 and 2025, 2026 generally remains at a higher monthly level, particularly from May through September. The data also shows considerable month-to-month variation, with peaks occurring in different months across the years rather than a consistent seasonal pattern. 

Overall, the trend demonstrates high volatility in ransomware activity, with 2026 exhibiting elevated activity and several significant monthly surges. 

Ransomware Activity — August 2026 vs. September 2026 

Ransomware activity declined from 1,165 victims in August 2026 to 850 in September 2026, a 27.0% month-over-month decrease. The decline was concentrated in the operators that had driven August's record: the fall in Qilin, Clop, Orova, DireWolf, and Everest alone accounts for roughly 270 fewer victims. 

Qilin fell from 164 victims in August to 74 in September (down 54.9%), while TheGentlemen eased only slightly from 113 to 105 (down 7.1%), which was enough to return it to first place. Storm moved from 41 to 37 (down 9.8%), and Krybit from 36 to 34 (down 5.6%). Akira grew from 31 to 36 (up 16.1%), and SafePay surged from 12 to 32 (up 166.7%). Settra held roughly steady, moving from 24 to 23 (down 4.2%). 

Several operators contracted sharply. Clop and Orova both fell from 45 to 2 (down 95.6%). DireWolf declined from 43 to 17 (down 60.5%), Everest from 27 to 12 (down 55.6%), and Dark Project from 25 to 5 (down 80.0%). ShinyHunters fell from 19 to 7 (down 63.2%), LockBit5 from 31 to 19 (down 38.7%), and Incransom from 44 to 29 (down 34.1%). DragonForce moved from 15 to 12 (down 20.0%). 

Offsetting part of the decline, AuditTeam (30 victims), Emperador (23), N0n (18), Panzer (18), Vexy Ransomware (18), MetaEncryptor (17), and Wallstreet (16) all registered significant volumes, together contributing roughly 140 victims. This reinforces the pattern of rapid turnover in the mid-tier, where groups surge for a month or two and then recede. 

As in prior months, leak-site counts do not always track the scale of individual incidents. FulcrumSec recorded only 2 listed victims in September yet was linked to one of the month's largest data thefts. The September decline may reflect a mix of natural oscillation after August's record, the retreat of mass-exploitation campaigns that had inflated earlier counts, and some attribution lag for the most recent days of the month. 

Industry Impact in September 2026 — Ransomware Continues to Target Critical Sectors 

In September 2026, ransomware attacks eased across nearly every major confirmed sector, with Manufacturing retaining the top position it claimed in August. 

Manufacturing recorded the highest confirmed victim count at 147, down 20.5% from August's 185 but still firmly in first place. Production-critical environments, where downtime creates immediate payment pressure, continue to attract the broadest range of operators. Professional Services recorded 99 victims, down 27.2% from August's 136, and moved ahead of Technology into second place. Technology recorded 95 victims, down 38.7% from August's 155, a decline that reflects the fading of the enterprise-software exploitation campaigns that boosted the sector the previous month. 

Healthcare recorded 82 victims, down 30.5% from August's 118, though the sector continued to face major incidents, including the theft of patient and employee data from a hospital operator and the notification of more than 437,000 patients by a surgical group over an earlier attack. Retail & E-Commerce (54 victims, down 28.9%) and Financial Services (40 victims, down 39.4%) also moderated. Education rose 22.2% to 33 victims from 27 in August, consistent with the start of the academic year and the exposure of school districts and universities. Transportation recorded 30 victims (down 30.2%), a figure that understates the month's operational impact given the disruption at a major Southeast Asian port and the claims against an airline and an airport group. 

Government & Defense recorded 28 victims, up 12.0% from August's 25, and was the other sector to grow. Activity included a large-scale theft from the Berlin state administration, attacks on U.S. county and municipal bodies, and claims against a national defence force in Africa. Agriculture and Food Production (25 victims, down 35.9%), Energy & Utilities (24 victims, down 27.3%), and Hospitality (20 victims, down 33.3%) rounded out the confirmed sector distribution. A total of 94 incidents fell under "Not Found" attribution, and a further 79 victims were assigned to a broader "Other" classification. 

Geographical Distribution of Victims 

The United States remained the most targeted country in September 2026 by a substantial margin, accounting for 269 victims and approximately 31.6% of global incidents. This was a 35.0% decline from August's 414 victims and a lower share than the 35.5% recorded the previous month. 

Germany recorded 38 victims, remaining the most impacted country outside the United States for a fourth consecutive month despite a 44.9% decline from August's 69. Brazil rose to 31 victims, up 14.8% from August's 27, moving into second place outside the United States, a rise partly driven by Emperador's focus on Brazilian targets. Italy recorded 28 victims (down 45.1% from 51), Canada 27 (down 12.9%), and the United Kingdom 26 (down 48.0% from 50). India (24 victims, down 11.1%) and France (23 victims, down 4.2%) held relatively steady. 

Argentina (17 victims, up 6.3%) and Spain (17 victims, up 30.8%) recorded modest gains, as did Japan (15 victims, up 7.1%). Mexico (13 victims) fell 45.8% and Australia (12 victims) fell 36.8%. South Korea, South Africa, Switzerland, and Türkiye each recorded 11 victims, with South Africa's count reflecting several incidents tied to a single third-party provider breach and a vehicle-tracking company. Russia and Sweden recorded 10 victims each, and Colombia 9. 

In Asia-Pacific, Taiwan (7 victims), Singapore (6), Indonesia (5), the Philippines (5), Thailand (5), and Vietnam (5) sustained consistent exposure, while Malaysia (3) saw one of the month's most disruptive incidents at a major port. Peru (6), Bulgaria (5), and Portugal (5) rounded out the upper tier of the remaining geographies. 

Victim organizations were identified across 91 countries and territories, up from 84 in August, including a long tail of countries across Africa, Latin America, the Caribbean, Central Asia, and the Middle East that each recorded a single victim. An additional 89 victims were recorded under an unresolved "Unknown" geographic classification, slightly below August's 99, though geographic attribution for the most recent reporting month often lags and should be interpreted with caution. 

Major Ransomware Breaches Across Global Sectors — September 2026 

During September 2026, ransomware and cyber-extortion activity produced a number of significant confirmed or claimed incidents across critical industries and regions. 

Public Sector — Germany 
Rhysida published roughly 5.3 terabytes of data (about 1.44 million files) stolen from the Berlin state administration after a ransom deadline expired on September 5. The attackers gained access in early August, and the intrusion was detected on August 14. It was described as the largest data theft in the history of Berlin's state administration. The group had demanded 30 Bitcoin (roughly €2 million), which the Berlin Senate refused to pay. The leak affected the Senate departments responsible for construction and transport and reportedly included personnel files, civil protection facility details, plain-text passwords, and banking information. German federal authorities warned of phishing and possible hack-and-leak operations ahead of the city's September 20 election. 

Maritime and Logistics — Malaysia and South Africa 
Ransomware halted operations at Malaysia's Port of Tanjung Pelepas, a major transhipment hub in the Strait of Malacca with annual capacity of around 14 million TEU, at 23:34 local time on September 9. Operations resumed the following day, but vessel schedules across multiple shipping strings were disrupted and backlogs extended for days. DireWolf subsequently claimed the attack. DireWolf also claimed a 500 GB theft from Cartrack, South Africa's largest vehicle-tracking company with 2.2 million subscribers. The company reported that its platform remained operational and notified the national Information Regulator. 

Healthcare — United States 
Nutex Health, which operates 28 healthcare facilities across 12 states, confirmed that patient, employee, provider, and business data was accessed and exfiltrated in an incident disclosed on August 24. TheGentlemen added the company to its leak site on September 1. The company reported the incident to the SEC as a material cybersecurity event and faced a proposed class action filed days after the disclosure. Separately, Proliance Surgeons notified more than 437,000 patients of an earlier ransomware attack, and Taiwanese biopharmaceutical firm PharmaEssentia filed a stock-exchange disclosure about its incident. 

Financial Services — South Africa and the United Kingdom 
South African insurer Hollard became the face of a broader third-party breach at MIP Holdings, a provider of policy administration and CRM services to roughly 45 South African insurers. Attackers used compromised credentials to reach the provider's project-management platform and file-transfer sites, and Hollard customer data subsequently surfaced on the dark web. TheGentlemen claimed the attack. Hollard rejected claims that its own systems were hacked and attributed the exposure to the provider. In the UK, Revolut confirmed that a malicious actor had impersonated a government agency using a legitimate government email domain to submit fraudulent data requests, obtaining identity documents, verification selfies, and account statements for a limited number of customers. Observers suggested wealthy individuals were the target. 

Aviation — Canada 
TheGentlemen listed Air Canada on its leak site on September 9, claiming to have obtained more than 51,000 files. At the time of reporting, the airline had not publicly confirmed the claim. 

Transportation and Hospitality — Japan 
Keio Corporation, a major Tokyo-area railway and retail group, shut down parts of its network after a ransomware attack on September 26 that disrupted card payment systems at group retail and hotel operations. Train operations were not affected, and no group had claimed responsibility. A separate incident at Tokyo Metro exposed roughly 59,000 members' email addresses. 

Public Sector and Education — United States and Europe 
Interlock claimed attacks on U.S. public bodies, including the city of Fort Smith, Arkansas, and Springfield Public Schools, both of which reported network disruptions. Booba Project listed Merrimack County in New Hampshire. In Europe, Kairos was linked to an attack on the French town of Libercourt in which personal data was exfiltrated, and Rhysida claimed a regional trade association in Germany. In Africa, RansomHouse claimed the Namibian Defence Force and threatened to publish sensitive defence material, a claim not independently verified at the time of reporting. 

Law Enforcement Action — Global 
On September 30, an operation involving ten countries dismantled the infrastructure of KillSec, a data-extortion group linked to hundreds of attacks over roughly two years. Authorities seized the group's leak site, five servers, and more than 110 terabytes of stolen data, searched eight residences, and arrested three suspects, including a 16-year-old believed to be the group's leader and a Dutch national arrested in the UK pending extradition to the United States. 

These incidents collectively underscore ransomware groups' continued emphasis on exposed credentials and keys as a primary access vector, the cascading impact of third-party provider compromises, the growing prominence of data-theft-only extortion, and a willingness to target transportation hubs, public administrations, and healthcare operators where disruption creates the greatest pressure. 

Recommendations — September 2026 Ransomware Outlook 

To mitigate the ongoing ransomware threat, organizations should continue strengthening defensive resilience through layered controls. The September 2026 incidents highlight several critical vectors requiring immediate attention, including exposed secrets in web code, third-party provider risk, social-engineering of legitimate request channels, and rapid exploitation of virtualization infrastructure. 

Conclusion 

The ransomware landscape in September 2026 reflected a sharp pullback from August's record, with 850 globally recorded victims distributed across 91 countries and 80 active threat groups, a 27.0% month-over-month decline. The ecosystem remains structurally resilient: volumes stayed above the levels recorded in May and June, and activity merely redistributed across a broader set of operators. 

The United States remained the most targeted country but saw its share fall to approximately 31.6%, while Germany remained the leading target outside North America and Brazil rose to second place outside the United States. Manufacturing retained its position as the most targeted confirmed sector, while Technology, Healthcare, and Financial Services all recorded notable declines and Education and Government & Defense bucked the trend with growth. 

The month's central story was TheGentlemen's return to the top, set against the steep retreat of Qilin, Clop, Orova, and DireWolf and the rapid arrival of AuditTeam, Emperador, Panzer, and a crowded field of new mid-tier operators. The Manchester Airports Group and Berlin state administration leaks, the shutdown of Tanjung Pelepas, and the third-party breach that exposed data from dozens of South African insurers show how data theft, supply-chain exposure, and operational disruption continue to compound one another. The dismantling of KillSec at month's end is a reminder that law enforcement pressure is growing, even as the ecosystem fragments faster than it can be disrupted. 

Ransomware remains a persistent, adaptive, and strategically driven threat. The rapid turnover of operators, the normalization of data-theft-only extortion, and the continued targeting of critical infrastructure, public administrations, and healthcare underscore the need for sustained investment in credential and secrets hygiene, third-party risk management, vulnerability management, detection, response, and recovery capabilities across all industries and organizational sizes.