Ransomware

Ransomware is a form of cyber extortion in which attackers encrypt or steal an organisation's data and demand payment to restore it or keep it private. Its victims include hospitals, schools, water utilities and cloud providers, so a single intrusion can halt services for hundreds of organisations and the people who rely on them.

Publicly disclosed victims rose by about a quarter in Black Kite's 2026 count, the United States and healthcare were the most targeted in July 2026, and a run of attacks hit Japan. Groups split the work among developers, affiliates, access brokers and negotiators and break in through unpatched servers; investigators said one gang also exploited poorly secured edge devices and used AI to help build its infrastructure and identify victims. Attacks in October 2026 reached a shared cloud platform and the backups meant for recovery. Attacker claims were not always confirmed, and police and prosecutors in Europe, Japan and the United States dismantled one gang and pursued members of two others.

As of October 2026, the KillSec gang's servers and leak site were in police hands, a suspected Qilin member was in German custody, and hundreds of IDC Frontier customers had been told to rebuild from their own backups.

Scale and targeting

Black Kite's 2026 ransomware report counted 7,551 publicly disclosed victims, up 24.9 per cent and extending a four-year climb. In July 2026 the United States accounted for 53 per cent of 111 publicly disclosed attacks, healthcare was the most targeted sector at 35 per cent, and about 47 per cent of incidents carried no attribution.

Qilin shows the reach of a single group in one country. Japan's National Police Agency said in October 2026 that Qilin had attacked 53 companies in Japan since April 2023, from manufacturers to hospitals and schools. Worldwide the group had attacked roughly 4,000 companies by that month, and it is believed responsible for the 2025 attack on beverage maker Asahi Group Holdings. Breach disclosures in Japan rose more broadly: Macnica logged 119 incidents involving data theft or exposure in 2026 by early October, against 84 in all of 2025, its researcher Yutaka Sejiyama said.

Affiliates and intrusion methods

Ransomware groups divide their labour. Qilin's core members develop the malware while affiliates carry out intrusions and extortion, and investigators in the KillSec case identified a suspected administrator, developer, negotiator and affiliate. Ryuk relied on initial-access brokers such as Karen Vardanyan, who, prosecutors said, broke into corporate networks that Ryuk affiliates then encrypted in 2019 and 2020.

Entry often comes through unpatched software. The China-based Warlock operator, tracked as Storm-2603, gained notoriety in mid-2025 by exploiting ToolShell, a chain of Microsoft SharePoint zero-days. More than a year later, Symantec reported that Warlock had hit a water utility, a telecommunications provider, a regional government body and a university through unpatched SharePoint servers. In one intrusion the attacker used a signed but vulnerable driver to switch off security software on at least 40 hosts within about two hours, then pushed the ransomware out from a share replicated to every domain controller. Investigators said KillSec exploited software vulnerabilities and poorly secured edge devices and that its members used artificial intelligence to help build their infrastructure and identify victims.

Cloud platforms and backups

Two attacks in October 2026 reached the systems organisations depend on to recover. On 7 October a ransomware attack on IDCF Cloud, run by SoftBank Group subsidiary IDC Frontier, stopped virtual servers in four availability zones of its East Japan Region 1 and affected 495 corporate and local-government customers, among them railways, police services and food logistics firms. JR East and its card arm View Card said up to 6.09 million records may have been accessed. An unattributed attacker claimed to have deleted more than 554,000 backup snapshots, and IDC Frontier said data could be restored only from customers' own backups.

At Osaka Metropolitan University, an attack that began on 2 October stopped about 500 servers and encrypted much of the backup data. Classes across all faculties were cancelled through 8 October, and at least 130,000 personal records of students, graduates and staff sat on the affected systems.

Extortion and disputed claims

Groups press victims by threatening to publish stolen data as well as by encrypting it. KillSec ran a dark web leak site where Group-IB counted 274 publicly claimed victims, with advertised demands of $5,000 to $50,000 per listing. Vardanyan and his Ryuk co-conspirators collected roughly 1,610 bitcoin, worth more than $15 million at the time.

Attacker claims were not always confirmed. DataSuckers claimed to have stolen data on 7.9 million customers of ATB, Ukraine's largest grocery chain, and demanded $400,000. ATB denied that any personal data was compromised, saying the attacked systems did not store it, and the claim could not be independently checked. Outlets gave slightly different figures from the IDCF attacker's console message, IDC Frontier did not say how much data was stolen, and no group claimed that attack.

Law enforcement

Operation KillSwitch, a multinational action on 30 September 2026, supported by Europol and Eurojust, shut down five KillSec servers, including its leak site, and seized at least 110 terabytes of stolen data. Spanish police identified the suspected main operator as a 16-year-old Romanian national arrested in Alicante province, and an alleged negotiator arrested in the United Kingdom was awaiting extradition to the United States. By October 2026 investigators had confirmed about 500 of roughly 1,000 suspected KillSec attacks as successful, a count officials said could change.

Japanese police detained a 28-year-old Russian national suspected of being a key Qilin member at an Osaka hotel in May 2026 and extradited him to Germany in October 2026, where he was arrested over the alleged extortion of a German logistics firm in 2024. Prosecution also reaches gangs that have shut down: in September 2026 a US court sentenced Vardanyan to two years in prison, years after Ryuk's operators moved on to Conti in 2020.