LeadershipNot yet confirmed elsewhere1 publisher2 min readPublished
Qilin and The Gentlemen are behind 32% of UK ransomware attacks, Cohesity data shows
Cohesity data puts Qilin and The Gentlemen behind 32% of UK ransomware attacks. UK volume rose 60% on the quarter, and a watchlist of two names covers a third of it, leaving 68% with other actors.
The Board Room · Leadership desk
Key figures: Qilin and The Gentlemen together were behind 32% of UK ransomware attacks. Qilin alone accounted for 19% and The Gentlemen for 13%. UK attacks rose 60% quarter-on-quarter, and 109 ransomware groups were active globally.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Qilin + The Gentlemen, UK share | 32 % of attacks | 2 | |
| Qilin share of UK attacks | 19 % of attacks | 3 | |
| The Gentlemen share of UK attacks | 13 % of attacks | 5 | |
| UK attacks, quarter-on-quarter | 60 % rise | 1 | |
| Active ransomware groups globally | 109 groups | 8 |
What happened
- Qilin was responsible for 19% of UK ransomware attacks last quarter, and Rapid7 Labs data indicates it made around $193 million between July 2025 and March 2026.
- The Gentlemen accounted for 13% of UK attacks, with victims mainly in industrial organizations and the IT sector and activity concentrated in Europe.
- Globally there were 109 active ransomware groups in the third quarter, and 35 of them were new.
Why it matters
- decision Security teams must decide how much of the quarter's effort goes to detections built around two named groups and how much to identity and lateral-movement controls.
- precedent The Gentlemen reached 13% of UK attacks after emerging only in July last year, so a leading share can form within about a year and make a fixed watchlist stale.
- exposure With the US share of recorded attacks down from 51% to 34% and European victims more than doubled, US-centred threat reporting describes a smaller part of what UK firms face.
- capability JadePuffer's demonstration of an agent running an entire intrusion chain without a human operator makes it possible for a new group to run campaigns without a large crew.
The case for a short watchlist rests on a comparison the data supports. Two groups are behind 32% of UK attacks [2], while globally the top five groups account for just over a third of listings [9]. By the number of groups needed to reach a third, UK activity is more concentrated than the world picture. The other side of the same figure is that 68% of UK attacks come from someone else [16].
A third of attacks coming from two names is a reason to tune detections to their methods first. We would start there but not stop there, for two reasons. Qilin's 19% is a one-quarter reading [3], and it comes from a single vendor's tally. ITPro's account of the same data also describes the number of ransomware groups as continuing to soar, indicating increasing fragmentation [15].
Cohesity's own field CISO frames the defence around technique. Julien Mousqueton said: "Organisations should be putting more focus on protecting identities and stopping attackers from moving through their systems, rather than relying on yet another layer of endpoint security." [14]
The UK growth figures look different depending on the window. Over the quarter, UK attacks rose 60% against 28% for global ransomware [1][10]. Over the year, they rose 42% against 86% globally [1][10]. Global ransomware hit a record high this quarter [10]. The UK's annual growth is about 0.49 of the global rate, so the quarterly jump is the larger outlier [17].
Two other sets of figures are hard to size. Mondays average 71 UK attacks and Wednesdays 64 [12]. Professional services, the most targeted UK sector, recorded 22 attacks in Q3 2026 [13]. A Monday average is about 3.2 times that quarterly sector count [18]. The ITPro article does not state the base for either number, so we would not size a UK exposure from them.
In our view the decision this quarter is how to split effort between detections built around Qilin and The Gentlemen and controls on identities and lateral movement. The first covers at most 32% of UK attacks on this data [2]. The second is tied to no group's share.
What to watch
- Whether Qilin and The Gentlemen still hold a combined 32% of UK attacks in Cohesity's next quarterly figures.
- Whether the next report states the base for the weekday averages and the sector counts, so the two can be reconciled.
- Whether the global top-five share stays near a third as new groups keep entering.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence42
- Adoption
- Insufficient
- Hype gap+20
- Incentives55
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
New Cohesity data shows UK ransomware attacks are up 60% quarter-on-quarter and 42% year-on-year.
- [2]
Just two hacking groups were behind nearly a third, 32%, of all UK ransomware attacks.
- [3]
Qilin was responsible for 19% of UK ransomware attacks during the last quarter, according to Cohesity.
- [4]
Data from Rapid7 Labs indicates Qilin made around $193 million between July 2025 and March 2026.
- [5]
The Gentlemen accounted for 13% of all UK ransomware attacks.
- [7]
The Gentlemen's victims are mainly industrial organizations, the IT sector, and some consumer spaces, and its activity is largely concentrated in Europe, with the UK and Germany among the most heavily targeted countries.
- [8]
There were 109 active ransomware groups globally in the third quarter, with 35 new hacking groups emerging.
- [9]
The top five ransomware groups globally accounted for just over a third of listings.
- [10]
Global ransomware hit a record high this quarter, up 28% on the previous quarter and 86% year-on-year.
- [11]
The US share of recorded ransomware attacks fell from 51% to 34% over the third quarter, while the number of European victims more than doubled, led by rises in Germany, the UK and Italy.
- [12]
Mondays are the most common day for UK ransomware activity, with an average of 71 attacks, followed by 64 per day on Wednesdays.
- [13]
The most targeted UK industries during the quarter were professional services with 22 recorded ransomware attacks in Q3 2026, followed by manufacturing at 17 and technology at 13.
- [14]
"Organisations should be putting more focus on protecting identities and stopping attackers from moving through their systems, rather than relying on yet another layer of endpoint security."
- [15]
While UK attacks come from two groups in particular, the overall number of ransomware groups continues to soar, indicating increasing fragmentation.
- [16]
The share of UK ransomware attacks not attributed to the two named groups is 68%.
- [17]
UK year-on-year growth of 42% is about 0.49 of the 86% global year-on-year growth rate.
- [18]
A Monday average of 71 attacks is about 3.2 times the 22 attacks recorded for professional services over the quarter.
- [19]
The Gentlemen are using AI models in negotiations and data triage, and hacking group JadePuffer demonstrated that an agent can execute an entire intrusion chain without a human operator.
Sources
1 independent publisher whose own reporting we read for this story.
- itpro.comTwo groups account for a third of UK ransomware attacks
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.