Victims confirmed 247 of a record 2,627 ransomware claims in Q3, Comparitech says

Victims have confirmed 9.4% of the quarter's claims ^[21]. The other 2,380 rest on the word of the group that claimed them ^[22]. Comparitech's report, published October 7, counts attacks claimed by ransomware groups, and the 247 confirmations came from the entities involved ^[5][11].

"Figures frequently fluctuate and a sector might see a bit of an increase one month, only to see a slight decrease the next month. However, Q3 2026 is different. We're not seeing slight increases or decreases. We're seeing significant increases across all key sectors," said Rebecca Moody, head of data research at Comparitech ^[6]. The growth she describes goes beyond the two fastest-rising sectors. Claims against education rose 50% on Q2, healthcare 39%, government 36% and utilities 32% ^[4]. Working back from the 27% quarterly rise puts Q2 at roughly 2,070 claims ^[23].

Qilin and The Gentlemen together claimed 699 attacks, 26.6% of the quarter ^[24]. Clop's 4,700% rise is one claim in Q2 becoming 48 in Q3, an increase of 47 ^[16][25]. Direwolf's claims rose 1,450% over the same period ^[17].

Germany followed the US with 121 claims, up 22% ^[19]. Claims against Argentina and India rose fastest on Q2, by 150% and 116% ^[20].

Infosecurity Magazine's account of the report offers developments in AI as a possible explanation for the surge. It says the technology lets attackers raise the scale, speed and effectiveness of campaigns ^[26]. It cites JadePuffer, a campaign researchers identified in July and believed to be the first ransomware attack completely driven by AI ^[7]. The account does not attribute any share of the 2,627 claims to AI-run operations ^[26].

Triple extortion adds a third step after encryption and data theft. The gang goes after the individuals affected by the attack, and the report found more attackers doing it ^[8]. The clearest case in the report involves The Gentlemen, second only to Qilin by claimed volume ^[15]. Moody said the group hit MIP Holdings, a South African tech company ^[9]. "After being targeted by the group in June 2026, MIP paid a ransom to have stolen data deleted. Over the last few weeks, however, The Gentlemen has started adding MIP's clients to its data leak site in a bid to get a ransom out of them, too," she said ^[9].

The victims refused in both of the quarter's largest known demands ^[13][14]. Everest asked Swiss railway manufacturer Stadler Rail for $12.3m in July and leaked 201 GB of stolen data after Stadler refused ^[13]. Rhysida demanded $2.3m from the State of Berlin, then published 5.7 TB, including citizens' personal information, after the state government publicly refused ^[14].