Ransomware Groups Claim Record 7,551 Victims as Qilin Activity Jumps 443%

Ransomware actors publicly claimed 7,551 victims between April 2025 and March 2026 (a 24.9% increase), driven by high-volume operations—notably Qilin/Agenda with 1,358 claimed victims—and an expanding ecosystem (146 active groups by June 2026). The report highlights concentrated impact on manufacturing and professional services, growing activity in Europe and the middle market, common attack paths (phishing, exposed remote services, compromised VPN/RMM, infostealer-derived credentials), double-extortion tactics, and systemic risk from trusted SaaS/vendor integrations that can expose many downstream organizations.