Ransomware victims reached record monthly high in October 2026

Cyfirma reported that cybersecurity trackers logged 1,178 publicly disclosed ransomware victims in October 2026. This figure represents a 36.7 percent increase from September 2026 and marks the highest monthly total since tracking began. Ransomware is a type of malware that holds private data hostage through encryption or data exfiltration until a payment is made. [1][2][8]

According to Cyfirma, the ransomware group Qilin returned to the top of the victim rankings with 177 claimed target organizations. Another group, named N0n, saw its claimed victim total increase from 18 to 142 during the month. Cyfirma added that 44 percent of all recorded victims were located in the United States. [1][2]

Cyfirma identified the professional goods and services, manufacturing, real estate and construction, and healthcare sectors as absorbing the highest number of extortion claims in October. The security firm noted eight main shifts in attacker methods, including multi-vendor edge access, offline virtual machine disk credential theft, and network-attached storage factory resets. [1][2]

Separately, the Hacker News reported that attackers targeted United States businesses in October 2026 through Microsoft 365 device-code phishing, fake artificial intelligence applications, credential theft, and malware campaigns. Ransomware attackers typically request payment in cryptocurrency to make financial transactions harder to trace. [3][4][8][10]