LONDON, September 17 — Ransomware attacks hit an all-time monthly high in August 2026, with 997 incidents recorded worldwide, according to data from Comparitech disclosed last month. That works out to 32 attacks a day, a 23% jump from 809 attacks in July and enough to break the previous monthly record of 988 set in February 2025. The shift is not just in volume.
It is in where the pressure is landing.
Utilities double, healthcare climbs
Utility companies recorded the sharpest sector increase, with attacks doubling from five in July to 10 in August. One utility attack has been confirmed to date, against Italy’s Alto Calore Servizi S.p.A., later claimed by Titan. It was not the first time the Italian water company found itself in the crosshairs: in August 2023, Medusa hit Alto Calore Servizi with a $100,000 ransom demand after breaching its systems.
Healthcare providers saw incidents rise 30% from July to August, climbing from 53 to 69, with eight attacks confirmed in August and three of those confirmed attacks taking place in the U.S. Among the confirmed healthcare incidents, Nutex Health Inc. noted unauthorized activity on its systems in an SEC filing on Aug. 24, 2026, claimed by The Gentlemen. Cedar County Memorial Hospital experienced disruption to its IT networks on the afternoon of Aug. 14, 2026, with operations returning to normal on the morning of Aug. 28, claimed by Wallstreet.
At Windrose Health Network, hackers exploited a vulnerability in the network’s remote-management tool in early August, resulting in a data breach, claimed by Storm. An attack on Canada’s Health Science Centre in Winnipeg affected certain facility maintenance systems, including door access, heating, ventilation and air conditioning, with no hackers claiming the attack. The group involved in an attack on Hvidovre Hospital in Denmark also remains unknown.
Rhysida issued SIA Medical Centre in Australia with a 6 bitcoin ($376,000) ransom demand, while Instituto Nacional de Cancerología (INCAN) in Guatemala confirmed it had not met its hackers’ demands, with KRYBIT claiming the attack; INC also claimed an attack on Policlinico Triestino in Italy.
Qilin and The Gentlemen lead the charge
Businesses accounted for 861 of the attacks, up 24% from 692 in July 2026, with 49 business attacks confirmed in August. The surge was led by ransomware groups Qilin and The Gentlemen, which together accounted for more than 26% of August’s attacks, with Qilin claiming 157 incidents and The Gentlemen 107. Qilin’s attack claims increased 22% during the month while The Gentlemen’s declined 21%; Qilin also had 12 confirmed attacks compared with eight for The Gentlemen.
Clop recorded the largest increase in claims, adding 45 victims to its site compared with one in July, with the attacks linked to exploitation of the PTC Windchill vulnerability. Comparitech recorded 23% more attacks against manufacturers in August, with 12 confirmed incidents, while attacks against retailers increased 30%.
Legal firms, finance companies and technology organizations recorded significant increases of 52%, 40% and 42% respectively; none of the attacks on legal firms have been confirmed, while five attacks each targeting finance and technology companies were confirmed. Rebecca Moody, head of data research at Comparitech, wrote in a company blog post: “The healthcare sector saw a 30 percent increase in attacks, but utility companies saw the biggest spike. Here, attacks doubled, rising from five in July to 10 in August.
Law firms (up 52%), tech companies (up 42%), and finance companies (up 40%) also saw significant increases. Education (down 4%) and the food and beverage sector (down 5%) were the only areas to see ransomware attacks decrease.”
Government targets hold steady
Attacks on government entities remained consistent in August, with 39 recorded compared with 38 in July 2026, and 18 attacks confirmed to date, nine of them in the U.S. From January to August 2026, 270 attacks on government entities were recorded, similar to the 267 attacks noted during the same period in 2025, with 124 attacks confirmed in 2026 so far.
The City of Coweta in Oklahoma and the City of Circleville in Ohio both confirmed they had not met their hackers’ demands, with the hackers unknown in both cases. The City of Fort Scott in Kansas, whose hackers are unknown, and the City of Mitchell in South Dakota, whose attack was claimed by Storm, both noted nearly a week of disruptions. The groups responsible for attacks against Suisun City in California, the Town of Lincoln in Maine, and the City of Norcross in Georgia also remain unknown. Wallstreet claimed an attack on the Town of Andover that disrupted schools in the area, and Qilin claimed an attack on the Bureau of Alcohol, Tobacco, Firearms
