Security 1 publisher2 min readPublished September 17, 2026 at 3:27 AM PDT

Talos puts 78% of Japan's ransomware victims under JPY 1 billion in capital

Cisco Talos's tally of Japanese ransomware for January to July 2026 hands the country lead to The Gentlemen, a crew that was not in last year's data and that listed 105 victims worldwide in July alone.

The Watch · Security desk

Illustration accompanying Talos puts 78% of Japan's ransomware victims under JPY 1 billion in capital

What happened

Cisco Talos counted 90 Japanese organizations hit by ransomware between January and July 2026, against 86 in the same months of 2025, with April the heaviest month at 19 incidents.
Victims capitalized under JPY 100 million made up 48% of the total, and those from JPY 100 million to JPY 1 billion another 30%.
Talos names Qilin, the most active group in Japan last year and second this year, as using AI to improve the efficiency of its operations.

Compiled by The WatchSomething wrong?How this is made

Why it matters

constraint Almost none of the groups seen in Japan in the first half of 2025 reappeared in 2026, so detection content and playbooks keyed to named families expire faster than the annual cycle most teams buy them on.
exposure With 13.3% of cases arriving through overseas offices and subsidiaries, most often in Taiwan, a Japanese parent's response scope now includes networks its domestic security team may not monitor.
capability If Qilin's use of AI holds up, victim throughput for that crew stops tracking headcount, and defenders lose the assumption that a small affiliate pool caps how many intrusions run at once.

The share moved more than the volume did. Talos counted four more Japanese victims than in the same seven months of 2025 ^[1]. Apply its capital brackets to both totals and the composition change shows up in whole companies: about 70 of this year's 90 victims were capitalized under JPY 1 billion, against about 59 of last year's 86 ^[2]. Victims at JPY 1 billion or more fell from roughly 27 to roughly 20 ^[3].

Talos states that shift two ways. Its summary says firms under JPY 1 billion are "approximately 80% of the total" and calls it "an increase of around 13% from the previous year" ^[7]. The body of the same post gives 78%, against 69% in 2025 ^[6]. The 13% is the ratio between the two shares; the gap between them is nine points ^[4]. Quoted as 13 points, the down-market move comes out half again as large as the data supports.

Fourteen of the 90 Japanese incidents were The Gentlemen's, about 16%, with Qilin and SafePay on seven each, so the top three carry 31% of the national total ^[8]^[5]. The group is far bigger outside Japan. Its leak site listed 48 victims worldwide in January, 87 in February and 105 in July ^[13]. It has run since about July 2025 as a ransomware-as-a-service operation using double extortion, and Talos says Russian-speaking individuals may be involved in its attacks ^[12]^[14].

Qilin is the continuity in the Japanese data: most active group there last year, runner-up this year ^[8]^[15]. Very few of the other groups seen from January to July 2025 turned up in the 2026 period ^[11], and this year's list also includes NightSpire, NetRunner, LockBit 5.0, RansomEXX, Stormous and AiLock ^[10]. Nobody was tuned for The Gentlemen last year, because it had not started operating ^[6].

The AI finding sits at the level of a summary line. Talos writes that Qilin is "leveraging AI to improve the efficiency of its operations" ^[15], and at that point in the post does not say which part of the operation the AI touches. Efficiency is a claim about throughput, not about a new technique.

The industry mix held. Manufacturing took 34% of Japanese incidents, information and communications 11% and services 9% ^[5]. Monthly volume averaged about 13 ^[3]. Talos says the full post also covers The Gentlemen's tooling, attack flow and attribution ^[16].

What to watch

Whether Talos publishes artifacts behind the Qilin AI finding rather than the efficiency claim alone.
Whether The Gentlemen's leak-site listings hold above 100 a month after July or the peak was a batch dump.
Whether the Russian-speaker attribution on The Gentlemen moves from possibility to a named affiliate set.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
According to Cisco Talos research, 90 organizations in Japan were affected by ransomware from January to July 2026.
ReportedSupportedSource: Cisco TalosView cited source
[2]
There were 86 incidents in Japan during the same January to July period the previous year, making 2026 an increase of approximately 4.7%.
ReportedSupportedSource: Cisco TalosView cited source
[3]
Japanese incidents averaged approximately 13 per month; numbers rose in March and April, with April the highest month at 19 incidents.
ReportedSupportedSource: Cisco TalosView cited source
[4]
Cases involving overseas offices and subsidiaries accounted for 13.3% of the total, with Taiwan recording the highest number, followed by the United States and the Philippines with the same number each.
ReportedSupportedSource: Cisco TalosView cited source
[5]
Manufacturing was the most affected industry at 34% of incidents, followed by information and communications at 11% and services at 9%.
ReportedSupportedSource: Cisco TalosView cited source
[6]
Organizations with capital of less than JPY 100 million were 48% of victims and those from JPY 100 million to less than JPY 1 billion were 30%; combined, organizations under JPY 1 billion were 78% of the total, up from 69% in 2025.
ReportedSupportedSource: Cisco TalosView cited source
[7]
Talos's summary states that organizations capitalized at less than JPY 1 billion accounted for "approximately 80% of the total", "an increase of around 13% from the previous year".
ReportedSupportedSource: Cisco TalosView cited source
[8]
The Gentlemen was the most frequently observed ransomware group in Japan in the first half of 2026 with 14 incidents, followed by Qilin, which caused the highest number of incidents last year, and SafePay, which had relatively few confirmed incidents in the same period last year, with seven incidents each.
ReportedSupportedSource: Cisco TalosView cited source
[9]
The Gentlemen and SafePay have increased their activity this year and can be considered emerging ransomware groups that require increased vigilance.
ReportedSupportedSource: Cisco TalosView cited source
[10]
Other ransomware groups observed in Japan in the period include NightSpire, NetRunner, LockBit 5.0, RansomEXX, Stormous and AiLock.
ReportedSupportedSource: Cisco TalosView cited source
[11]
Very few of the groups that were active in Japan during the same period last year have been observed this year.
ReportedSupportedSource: Cisco TalosView cited source
[12]
The Gentlemen has been active since around July 2025, expanding through a ransomware-as-a-service model and using double extortion, encrypting victims' data while threatening to publish stolen information.
ReportedSupportedSource: Cisco TalosView cited source
[13]
Listings on The Gentlemen's leak site worldwide rose from 48 in January 2026 to 105 in July, approximately a 2.2-fold increase, with a sharp rise to 87 in February and relative stability from March through May.
ReportedSupportedSource: Cisco TalosView cited source
[d1]
Japan recorded four more ransomware victims in January to July 2026 than in the same months of 2025.
DerivedSupported1 source— sign in to open
[d2]
About 70 of the 90 victims in 2026 were capitalized under JPY 1 billion, against about 59 of the 86 in 2025, roughly 11 more small-company victims.
DerivedSupported1 source— sign in to open
[d3]
Victims capitalized at JPY 1 billion or more fell from about 27 in 2025 to about 20 in 2026, roughly seven fewer.
DerivedSupported1 source— sign in to open
[d4]
The rise in the under-JPY-1-billion share is nine percentage points in absolute terms and about 13% in relative terms.
DerivedSupported1 source— sign in to open
[d5]
The Gentlemen accounted for about 16% of Japan's 90 incidents, Qilin and SafePay about 8% each, and the three groups together 31%.
DerivedSupported1 source— sign in to open
[d6]
Because The Gentlemen began operating around July 2025, it could not appear in Japanese incident data for January to July 2025.
DerivedSupported1 source— sign in to open
[14]
There is a possibility that Russian-speaking individuals are involved in The Gentlemen's attacks.
ReportedInsufficientSource: Cisco TalosView cited source
[15]
Qilin, which recorded the second-highest number of observed incidents in 2026 after The Gentlemen, is "leveraging AI to improve the efficiency of its operations".
ReportedInsufficientSource: Cisco TalosView cited source
[16]
The post says it provides an overview of The Gentlemen, the tools it uses, attack flow and findings related to its attribution, as well as examining Qilin's use of AI.
ReportedInsufficientSource: Cisco TalosView cited source

Sources

Publishers with included, body-backed reporting in this cluster.

blog.talosintelligence.com
1 article · September 17, 2026
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The usable material for engineers is the inventory of names: The Gentlemen, Qilin, SafePay, NightSpire, NetRunner, LockBit 5.0, RansomEXX, Stormous and AiLock. Talos describes The Gentlemen as a ransomware-as-a-service operation running double extortion since about July 2025, and says it found open directory infrastructure used by an actor tied to the group. The counts describe who is attacking. The infrastructure and tooling sections are where a defender finds something to act on, and those sit further down the post.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence52

0100

One vendor's count, checkable but unverified

Every figure in this story traces to Cisco Talos's own Japanese tally, drawn from cases that fell within Talos's own visibility. The numbers are at least specific enough to check by hand, and they mostly hold: 78% of 90 is about 70 victims, 69% of 86 about 59. The post also disagrees with itself in small ways, calling 78% approximately 80% and a nine-point rise around 13%. That keeps this mid-range rather than high.

Adoption60

0100

Counted victims, small numbers

Adoption here means the threat's own footprint, and Talos counts it: 90 Japanese organisations in seven months, 14 of them attributed to The Gentlemen, and a worldwide leak-site series that ran 48 listings in January, 108 in June and 105 in July. The Japanese counts are real but thin. A 14-to-seven lead over two other groups would change hands on a handful of unreported cases.

Hype gap+15

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

build
A process created at boot lets one HTTP request take root on Cisco's firewall console
1 publisher
security
Rubrik wires ReversingLabs' ransomware feed into the scans that pick a clean recovery point
1 publisher
security
The Gentlemen affiliates encrypt within a day of logging into a VPN with a stolen password
1 publisher
security
Nutex discloses stolen patient data breach to SEC, says it is still assessing what was taken
3 publishers

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources