A security leader opens three ransomware reports before a budget meeting.
One says there were 7,551 victims. Another records more than 3,600 complaints. A third says ransomware appeared in 48% of breaches. All three numbers are credible, yet none describes the same population.
If the leader presents them as interchangeable, the board receives a dramatic story but a weak risk picture. If the team understands how the numbers were produced, the reports become useful.
The important question is not, “How many ransomware attacks happened?” It is, “What does each number reveal about how attacks succeed and how organisations recover?”
Start by correcting the headline
Black Kite’s 2026 Ransomware Report counted 7,551 publicly disclosed ransomware victims between 1 April 2025 and 31 March 2026, an increase of 24.9% over its previous reporting period.
That is not a calendar-year 2026 total, and it is not a complete count of every ransomware incident. It is a twelve-month set of publicly identified victims observed through Black Kite’s research.
The distinction matters. Many organisations never appear on a criminal leak site. Some negotiate privately, restore without paying, or do not disclose publicly. A criminal group may also name an organisation without providing enough evidence for an independent observer to confirm every detail.
Public victim tracking is therefore a useful measure of visible extortion activity—not a census of all ransomware.
Three datasets, three different views
The 2026 evidence is easier to understand when we stop asking the sources to measure the same thing.
| Source | Reported number | What it measures | What it does not prove |
|---|---|---|---|
| Black Kite 2026 Ransomware Report | 7,551 victims | Publicly disclosed victims observed from April 2025 to March 2026 | Every attack, payment, or confirmed encryption event worldwide |
| FBI Internet Crime Complaint Center 2025 report | More than 3,600 complaints and over $32 million in reported losses | Ransomware complaints voluntarily reported to the FBI’s IC3 during 2025 | Total US incidents or the full business impact of ransomware |
| Verizon 2026 Data Breach Investigations Report | Ransomware present in 48% of analysed breaches | The share of breaches in Verizon’s contributed incident dataset that included ransomware | The percentage of all organisations attacked worldwide |
The FBI’s 2025 IC3 Annual Report is based on complaints submitted to a law-enforcement reporting channel. Under-reporting is unavoidable. Its loss figure also should not be read as the total cost of ransomware: business interruption, forensic investigation, legal work, system rebuilding, customer support, and long-term recovery may not appear as direct losses in a complaint.
The 2026 Verizon Data Breach Investigations Report analyses a large collection of incidents contributed by participating organisations. Its 48% figure shows how often ransomware appeared within that dataset. It does not mean that 48% of all companies suffered ransomware.
None of these sources is wrong because it reports a different number. The mistake is removing the number from its method.
What the numbers do tell us
Ransomware is usually the final business impact, not the first technical event
Teams often plan for ransomware as though a malicious encryption program suddenly arrives and starts locking files. In many cases, the damaging event comes later.
An attacker may first use stolen credentials, exploit an exposed service, or enter through a supplier. They then establish access, increase privileges, discover systems, steal data, weaken recovery options, and move toward important workloads. Encryption or an extortion demand is the visible end of that sequence.
This changes the defensive question. Buying another malware scanner may help, but it cannot compensate for weak identity controls, unpatched internet-facing systems, unrestricted administrative access, or a flat network.
More named groups do not always mean more independent capability
Black Kite reported more than 60 new ransomware groups during its reporting period. That sounds like dozens of completely new criminal organisations. Some will be new. Others may be renamed operations, former affiliates, short-lived brands, or reorganised members of disrupted groups.
Security teams should not build a separate defence plan for every criminal name. Group-specific intelligence helps active investigations, but durable controls should focus on behaviours shared across many attacks: credential theft, remote access abuse, privilege escalation, lateral movement, data exfiltration, backup tampering, and extortion.
Lower payments would not mean lower operational risk
The 2026 Verizon report says ransomware appears in a larger share of the breaches it studied while ransom payments are shrinking. These trends can exist together.
More victims may refuse to pay, law enforcement may disrupt payment routes, and organisations may improve recovery. Attackers can respond by stealing data before encryption, threatening customers, or increasing pressure on suppliers and executives.
Payment is only one outcome. A company that pays nothing can still lose weeks of operation, expose sensitive data, rebuild hundreds of systems, and face legal or regulatory consequences.
Third-party access changes the boundary of preparation
An organisation can improve its own controls and still depend on identity providers, managed service providers, software suppliers, backup platforms, and specialist operational vendors.
The practical lesson is not to demand a generic security certificate from every supplier. It is to identify which suppliers can reach important systems, what permissions they hold, how their accounts are monitored, whether access can be disabled quickly, and what happens when their service becomes unavailable.
Third-party risk becomes operational when a vendor connection can reach production.
Five questions security teams should answer now
1. Can one stolen account reach critical systems?
Enforce multifactor authentication, especially for remote access, email, administrators, and systems that control identity. Prefer phishing-resistant methods for privileged access where possible. Separate everyday accounts from administrative identities and remove access that is no longer required.
2. Can an attacker move freely after entering?
Limit unnecessary connections between user devices, servers, management systems, and backup infrastructure. This is network segmentation: dividing the environment so that access to one area does not automatically provide access to everything.
Segmentation is useful only when the rules are tested. A network diagram showing separate zones means little if broad firewall rules quietly reconnect them.
3. Can the organisation restore without trusting the compromised environment?
CISA’s StopRansomware Guide recommends offline, encrypted backups and regular restoration testing. The word tested matters more than the word backup.
A successful backup job proves that data was copied. A recovery exercise proves whether the organisation can rebuild identity, configuration, applications, dependencies, and data within an acceptable time. Backups should also be protected from the same administrator accounts used in the production environment.
4. Will the team see the attack before encryption?
Detection should cover the steps that come before the ransom note: unusual remote logins, new privileged accounts, disabled security tools, large data transfers, rapid access to many systems, changes to backup policies, and suspicious use of administrative tools.
Collecting logs is not the same as detecting an attack. The team needs alert ownership, escalation paths, and enough context to decide whether unusual behaviour is legitimate.
5. Can the business make decisions under pressure?
An incident plan should identify who can isolate systems, shut down access, contact law enforcement, engage insurers and legal counsel, communicate with customers, and make decisions about extortion demands.
Run exercises that include business leaders, not only the security team. The difficult choices are rarely limited to malware removal. They involve patient care, production, payroll, customer commitments, privacy obligations, and public communication.
Measure readiness, not fear
Industry victim counts help leaders understand the wider threat. They are poor substitutes for internal evidence.
A security team should be able to report operational measures such as:
- the percentage of privileged and remote accounts protected by strong multifactor authentication;
- the time required to disable a compromised identity across connected systems;
- the age of critical internet-facing vulnerabilities;
- the last successful restoration test for each important service;
- the time required to detect and contain suspicious lateral movement;
- the number of suppliers with privileged production access; and
- the business services that still lack a tested recovery plan.
These measures are less dramatic than a global victim count. They are also more useful, because the organisation can act on them.
What the 2026 numbers really mean
The evidence does not support one perfect total for ransomware. Public disclosures, law-enforcement complaints, and breach investigations observe different parts of a hidden criminal market.
Together, however, they support a clear conclusion: ransomware remains common, the criminal ecosystem can reorganise quickly, and the damage extends beyond ransom payments. The strongest defence is not a product labelled “anti-ransomware.” It is a chain of controls that limits entry, restricts movement, protects recovery, detects suspicious behaviour, and prepares leaders to act.
Do not use 7,551 victims merely to frighten a board. Use the number to ask whether one compromised account, one exposed system, or one trusted supplier could turn your next incident into a company-wide shutdown.
References and further reading
- 2026 Ransomware Report — Black Kite. Explains the 7,551 publicly disclosed victim count, its April 2025–March 2026 reporting period, and changes observed across ransomware groups.
- 2026 Data Breach Investigations Report — Verizon. Provides incident-based analysis of ransomware, breach patterns, third-party involvement, and payment trends.
- 2025 IC3 Annual Report — Federal Bureau of Investigation. Provides complaint and reported-loss data submitted to the Internet Crime Complaint Center.
- StopRansomware Guide — Cybersecurity and Infrastructure Security Agency. Practical guidance covering prevention, backups, segmentation, detection, and incident response.