Ransomware attacks keep rising. According to British security firm NCC Group's quarterly report, the third quarter of 2026 saw 2,865 ransomware victims, up 23% from 2,325 in the second quarter. The figures are based on organizations the gangs themselves posted on their leak sites, so the real number is probably higher: organizations that paid quietly do not appear.
The hardest-hit sector was industry, with about 29% of attacks. Factories are especially attractive targets for several reasons: they cannot afford to halt production lines for long, so pressure to pay is high. Many run old systems that are hard to update and are now connected to networks. And they depend on chains of suppliers, so a breach at one can spread to others.
The most active gang in the quarter was Qilin, with 365 victims according to NCC Group, followed by The Gentlemen, a fast-growing gang. Qilin runs a 'ransomware as a service' model: the gang's developers supply the tools, and affiliates carry out attacks and share the profits. That model lets one gang be behind hundreds of attacks at once.
What can we learn from the numbers? That ransomware is no longer a rare event that happens to others but a routine business risk, like fire or theft. Organizations, including factories and small businesses in Israel, should treat it that way: tested offline backups, software updates, two-step verification for all remote access, and a plan ready in advance. If you wait until the screen fills with a ransom note, it is already too late.
