Figures are publicly claimed ransomware victims observed by Cyble Research and Intelligence Labs between 1 and 31 August 2026. Counts reflect claims posted to leak sites and actor channels; they are a floor, not a ceiling, and exclude incidents resolved without public disclosure. Regional tables count victims by victim location. Group, country, sector and regional tables count individual claim records (1,078). The headline victim figure (1,034) counts distinct organisations — 24 organisations were claimed by more than one group during the month.
CRIL observed 1,034 publicly claimed victims across 1,078 recorded attacks in August 2026 an average of 33 victims per day.
The distribution is what matters: a handful of prolific operators account for more than a third of all activity, while the remaining eighty-three groups divide the rest.
