NCC Group said August 2026 ransomware activity hit a new year high, with 1,073 incidents, while industrial targets rose to 31% of attacks and Qilin overtook The Gentlemen as the most active group. The firm’s monthly snapshot also showed North America carrying the largest share of incidents.
The shift matters because the mix is changing, not just the total. Industrial and manufacturing environments are drawing a larger share of extortion pressure, and the top actor changing hands suggests the market is still fluid rather than settled around one dominant gang.
For industrial operators, the report is a map of where ransomware crews are concentrating now: on operational environments with downtime leverage. What it does not settle is which gang will hold that lead next month, or whether this concentration will hold.