Ransomware attacks saw a significant increase of 19 percent in July compared to June, according to a new report by Comparitech. The finance, technology, and healthcare industries were particularly affected by this surge. Comparitech recorded a total of 799 ransomware incidents in July, making it the second highest month for such attacks in 2026. This marks one of the highest monthly figures in the past 17 months. The finance sector experienced a dramatic 71 percent increase in attacks from June to July, followed by technology with a 62 percent rise, healthcare at 46 percent, and education at 44 percent. The report also noted a 31 percent increase in attacks targeting organizations based in the United States.
Several high-profile incidents were highlighted in the analysis. Among them was an attack on the US healthcare provider AnMad, which led to the closure of its facilities. Another significant incident involved the Romanian government's land registry agency, where an entire database was wiped, causing major disruptions in the real estate market. Rebecca Moody, head of data research at Comparitech, emphasized the critical need for organizations to conduct regular backups of their systems to quickly restore operations in the event of an attack.
The analysis, published on August 5, revealed that the ransomware groups The Gentlemen and Qilin accounted for 33 percent of all attacks in July. The Gentlemen claimed responsibility for 135 attacks, while Qilin was behind 125. These two groups appear to be in a competitive battle for dominance in the ransomware landscape, with The Gentlemen recently overtaking Qilin as the most active threat actor between March and May 2026. Other active groups in July included DragonForce, INC, CRPx0, and SafePay, though they accounted for fewer attacks compared to the leading groups.