Research · Latest Ransomware Report

The quarterly record of ransomware, disclosed and not.

Since 2020 BlackFog has published a continuous count of ransomware activity, combining publicly disclosed incidents with attacks found on dark web leak sites. It is the same research our own detection is built on, and we publish all of it.

Download the latest report
Q2 2026 State of Ransomware Report

q2 2026 at a glance

306

publicly disclosed ransomware attacks in Q2 2026, level with Q2 2025 after five years of growth.

97%

of disclosed attacks ended in data exfiltration – the highest rate ever recorded.

1 in 8

attacks is ever made public. We identified 2,027 undisclosed attacks in Q2 2026 alone.

$25M

largest disclosed ransom demand of the quarter, made against Novo Nordisk.

HOW THE RESEARCH IS BUILT

Counted, not estimated

Every figure in the report traces back to a specific incident. Nothing is modeled, extrapolated, or supplied by a third party.

Disclosed incidents

Attacks confirmed publicly by the victim, a regulator, or the press, logged individually with sector, geography and attributed group.

Dark web leak sites

Continuous monitoring of ransomware leak sites surfaces the attacks that never reach public disclosure, which outnumber those that do by more than six to one.

Exfiltration analysis

Each incident is checked for confirmed data theft, which is what makes the report a measure of extortion leverage rather than encryption events.

from the archive

Register for past reports

Each quarter is published in full and stays available.

Q2 2026 Ransomware report

Sign up.

STAY AHEAD OF THE CURVE

Get the latest research, as it’s published