Ransomware in 2026: More groups, more victims, no slowdown

Black Kite's 2026 Ransomware Report describes a fragmented and accelerating ransomware ecosystem (April 2025–March/June 2026) with 7,551 recorded victims, 61 new groups entering the market and 146 active groups by June 2026; the U.S. accounted for 49.3% of victims, manufacturing and professional services were top targets, and attackers increasingly combine encryption and data theft while exploiting SaaS/ERP/OAuth, remote access, and AI-enabled social engineering (voice phishing, deepfakes) to scale campaigns.