Global ransomware activity reached a record 997 attacks in August 2026, averaging about 32 attacks a day and surpassing the previous monthly record of 988 recorded in February 2025.
Businesses accounted for most of the incidents, while healthcare, utilities, finance, technology and manufacturing were among the sectors facing increased attacks.
How Many Ransomware Attacks Were Recorded?
A total of 997 ransomware attacks were recorded worldwide in August, up 23% from 809 attacks in July.
Businesses accounted for 861 attacks during the month, a 24% increase from 692 in July. Government entities recorded 39 attacks, compared with 38 in the previous month.
The figures made August the highest monthly total recorded, exceeding the previous record of 988 attacks from February 2025.
Which Industries Faced the Biggest Increase?
Utility companies recorded the sharpest increase, with attacks doubling from five in July to 10 in August.
Healthcare attacks increased 30%, rising from 53 to 69. Law firms recorded a 52% increase, technology companies 42% and finance companies 40%.
Retail attacks increased 30%, while attacks against manufacturers rose 23%. Education and food and beverage were among the few sectors where ransomware activity declined, falling 40% and 5%, respectively.
How Badly Was Healthcare Hit?
Healthcare providers faced 69 ransomware attacks in August, compared with 53 in July. Eight attacks were confirmed during the month.
Three confirmed attacks took place in the United States, affecting healthcare organisations and causing disruptions in some cases. Other incidents were reported in Canada, Denmark, Australia, Guatemala and Italy.
In Australia, one medical centre received a ransom demand of six bitcoin, valued at about $376,000.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What Happened to Government Networks?
Government ransomware activity remained relatively stable, with 39 attacks in August compared with 38 in July. Eighteen of the August incidents had been confirmed.
Nine confirmed attacks occurred in the United States. Several local governments reported attacks, while a ransomware incident affecting a town in Washington disrupted schools in the area.
Germany also saw an incident involving a 30 bitcoin ransom demand, valued at $2.3 million, for deletion of 5.79 TB of data. The demand was refused.
From January to August 2026, 270 attacks against government entities were recorded, compared with 267 during the same period in 2025. Of these, 124 attacks had been confirmed in 2026.
How Were Businesses Targeted?
Businesses recorded 861 ransomware attacks in August, with 35 confirmed incidents.
Five confirmed attacks each were recorded against finance and technology companies. Among the finance-sector victims was a payments company in India.
Technology-sector incidents included attacks in Japan, India, the United States and South Africa. One company in Japan reportedly had 437 GB of data stolen, while 100 GB was stolen in an attack against a South African company.
Manufacturers recorded 12 confirmed attacks during August, while retailers recorded eight.
Which Countries Saw the Biggest Rise?
Attacks in the United States increased 28% during the month, with one ransomware group responsible for a significant share of its claims.
Italy and Taiwan recorded the largest increases. Attacks in Italy rose 200%, from 16 in July to 48 in August. Taiwan also recorded a 200% increase, rising from seven attacks in July to 21 in August.
Germany recorded a 14% increase, while the United Kingdom saw a 44% increase. India recorded an increase of 20%.
What Should Organisations Learn From the Surge?
The record number of attacks shows that ransomware remains a threat across healthcare, government, finance, technology, manufacturing and other sectors. Organisations should treat network security, vulnerability management and incident preparedness as continuing priorities, particularly as attacks can involve operational disruption, stolen data and ransom demands.
The420 Security Brief: Ransomware Is Not Slowing Down
Nearly 1,000 ransomware attacks in a single month show how widely the threat now reaches across industries and countries. The sharp increases in sectors such as healthcare, utilities, finance and technology underline the need for organisations to strengthen security before an attack disrupts operations or exposes sensitive data.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
