The Gentlemen overtake Qilin as ransomware listings climb to 2,894
A breakaway gang now leads the field after outbidding its rival for affiliates, while about two in three named victims employ 200 people or fewer
- Leak sites monitored by Nord Security: more than 200
- Most attacked countries in Q3: US 805, Germany 84, Canada 73
- 69 attacks on UK organizations in Q3, against 74 in Q2 and 79 in Q1
- Third most active group: INC Ransom, with 110 attacks
Nord says both leading groups get in through stolen credentials and exposed VPNs. Noreika said Akira has spent more than a year using leaked VPN logins and weak multi-factor authentication to reach small firms, and that INC Ransom has worked through law firms one after another. He added that flaws already public in common enterprise products are still among the most frequent ways in.
“There’s no single ransomware model to defend against anymore.”Vakaris Noreika, cybersecurity expert, NordLayer Intelligence by NordStellar
Nord Security counted 2,894 ransomware incidents between July and September 2026, 8.6% more than in the second quarter and nearly 50% more than the 1,933 it recorded a year earlier. The figures, published by its NordLayer Intelligence unit in October, come from victim listings on attacker-run leak sites, and Nord sells network security and threat intelligence tools.
The Gentlemen posted 383 attacks, up 35%, and moved ahead of Qilin, which reached 363 despite its own 21% increase. According to Nord, the group's founder appears to have run one of Qilin's top affiliate crews before leaving over an unpaid cut, and recruited former colleagues with a 90% share of ransoms, against the usual 70–80%.
Companies with 11–200 staff accounted for nearly half of attacks, and businesses with revenue of $5m–$50m (£3.7m–£37m) were the most targeted bracket. Attacks on companies with more than $1bn in revenue fell from 40 to 25.
Manufacturing remained the most attacked sector with 347 incidents, 18.5% of the total. IT rose about 10% to 210, and healthcare rose 30% to 150, the sharpest increase of any major sector. Nord's researchers attribute part of the rise to groups that skip encryption and only steal data and threaten to leak it, which lets a single group work through more victims.
Sources
- Nord Security, “Ransomware Statistics and Trends, Updated Quarterly” (Q3 2026), NordLayer Intelligence, 21 October 2026. https://nordlayer.com/intelligence/ransomware-statistics/
- Infosecurity Magazine, “Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy”, 21 October 2026. https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/
