Ransomware attacks surged by 19% in July compared to June, with finance, tech and healthcare industries heavily impacted, new analysis by Comparitech has found.
The consumer service firm observed a total of 799 claimed ransomware attacks in July, making it the second highest month of 2026 following a relative lull in April, May and June.
The number recorded in July 2026 is also the third highest month for ransomware attacks in the past 17 months, according to Comparitech.
The sector that experienced the biggest month-by-month increase in attacks was finance at 71%, followed by technology (62%), healthcare (46%) and education (44%).
July also saw a jump in attacks targeting US-based organizations, up by 31% from June.
Several major confirmed incidents were highlighted in Comparitech’s July analysis due to their impacts. This included an attack on US healthcare provider AnMad, resulting in the closure of facilities.
Another was an incident affecting the Romanian government's land registry agency, which resulted in an entire database being wiped and significant disruption to the country’s real estate market.
Rebecca Moody, head of data research at Comparitech, commented: “These attacks highlight how ransomware groups hit organizations in various different ways – taking down key systems, stealing troves of data, and even deleting massive datasets. Never has it been more important for organisations to ensure they're carrying out regular backups (and backups of their backups!) so they can reset systems and restore data as quickly as possible if the worst does happen."
The Gentlemen and Qilin Continue to Dominate
Comparitech’s analysis, published on August 5, found that The Gentlemen and Qilin groups together accounted for 33% of all attacks in July, the former claiming 135 attacks and the latter 125.
These figures show a continuation of a “battle” for supremacy between these two ransomware strains.
An analysis by ReliaQuest found that The Gentlemen group emerged as the most prolific threat actor behind cyber extortion campaigns between March and May 2026, usurping the previously dominant Qilin outfit.
These two groups were significantly more active than other ransomware actors in July. The next most active group was DragonForce, making up 41 attacks, followed by INC (36), CRPx0 (33) and SafePay (30).
Read now: A New Ransomware Threat Actor Emerges Every Week, Warns Report