The State of Ransomware in Q3 2026

Writing quarterly reports that highlight ransomware activity and its risks is something that I look forward to, but it can sometimes feel repetitive. This isn’t to minimize the significant and long-lasting impacts that the thousands of victims face on their arduous road to recovery, or the need for ongoing vigilance, but at times truly noteworthy subjects to cover can be hard to find. This quarter isn’t one of those: there’s been a LOT going on. In this quarterly post, along with the usual look at the ransomware numbers, I’ll touch on some news items, including a striking wtf were they thinking? story.

AI risk, part one: rogue agents

AI going rogue has continued to be a common news item in Q3, with reports of models breaking out of sandboxes to achieve whatever goal they’ve been tasked with. Beginning in July, OpenAI revealed that during testing its models escaped their sandbox and autonomously compromised several companies. Not to be outdone, on July 30 Anthropic announced its Claude model was similarly naughty.

I’m sure we’ll see some eye-popping achievements with AI in the future, but my own take is that there’s a degree of self-promotion and marketing behind these headlines. A quote I saw recently captures the situation nicely:

Every OpenAI “rogue agent” report can be summarized as “Our AI agents were not intended to access the internet under any circumstances, which is why we gave them a direct path to the internet and obstructed it with a wet paper bag”. – Marcus Hutchins, cybersecurity researcher.

I don’t know the actual level of risk that these frontier AI companies and their agents pose, today or in the future, and frankly I don’t believe the people leading these companies know either. An abundance of caution suggests that navigating our path forward should be managed by those who transparently serve the public rather than executives with a fiduciary responsibility to shareholders.

AI risk, part two: attacks on data centers

Something I’ve noticed with two ongoing wars is that at least two belligerents have been attacking data centers. Iran launched drone strikes on multiple AWS data centers in Bahrain and the United Arab Emirates in March, and Amazon reports that they are “unable to restore access to the resources and data”. Russia, on the other hand, has maintained an ongoing operation targeting Ukrainian data centers.

Undoubtedly, all war is abhorrent, and targeting civilian objects is a war crime, but I find it illuminating that in both cases, kinetic attacks were used. Both Iran and Russia are in the top 3 countries identified as being responsible for cyber incidents with a political dimension between 2000 and 2023, and China, with top spot out the political cyberattack podium, being friendly to both. Why not use AI to launch a cyberattack: it’s a more precise, and probably less expensive way to take down a data center? The fact that a cyberattack wasn’t used may indicate that current offensive AI models have limited effectiveness in real-world situations.

Infrastructure attacks

Dozens of municipal water, wastewater, and energy facilities across at least 12 states faced cyberattacks in Q3 2026. An FBI alert on July 30 warned that threat actors were targeting internet-exposed PLCs – the computer systems used to monitor and control the industrial processes of these facilities. Attacks on US infrastructure aren’t new, and the vulnerabilities of municipal systems are understood. Attribution for the attacks hasn’t been determined, but hostilities with Iran have made them a prime suspect.

Municipal water systems often operate with limited budgets, and their personnel may not have expertise in cybersecurity. Hacking these vulnerable targets, of which there are thousands in the US, can be an effective way for Iran to exert pressure on the current administration to acquiesce to Iranian demands for a favorable peace deal.

ShinyHunters’ banner year

ShinyHunters continues to demonstrate their brash behavior, first of all by hacking the dark web site of ransomware group Cl0p apparently because they’d threatened ShinyHunters. The Cl0p DLS site has since returned to normal, and while public disagreements between ransomware groups aren’t unheard of, they sometimes demonstrate a level of bravado that often backfires.

Also in September, ShinyHunters claimed to have stolen data related to FBI agents, apparently because mean things were said about them on the FBI website. There’s a thin-skinned theme recurring, and this reaction was profoundly ill-advised, and the only possible explanation that I can think of is that the young brains of those responsible remain under active construction. Possibly realizing the self-harm they were causing, they told CBC that they had no intention of releasing the stolen data, but the horse had left the barn: the FBI has understandably focused their attention on punishing those responsible. The incident is certainly embarrassing for the legendary law enforcement agency: ShinyHunters, although formidable hackers, are believed to largely be a loose affiliation of teenagers and young adults rather than a nation-state group with considerable resources at their disposal. The fallout from this episode is ongoing, with timeline of events thus far:

• September 15: Dutch hacker Pepijn Van der Stap (aka “Umbreon”) was arrested by Dutch authorities, according to DataBreaches.
• September 22: ShinyHunters claims to have stolen the personnel information of thousands of F.B.I. officials the day before;
• September 29: ShinyHunters tells CBC that they won’t release the stolen data.
• September 29: The FBI announce the arrest of “one of the alleged leaders of ShinyHunters”. This is the same arrest by Dutch authorities mentioned above that took place 2 weeks earlier.
• October 1: ShinyHunters’ dark website goes very dark. As in offline, although there’s no indication that it was seized, and the site has come back online.
• October 3: Another suspected member was detained in Jordan, and reportedly is cooperating with the FBI, although not technically in Q3.

By the numbers

As we’ve done before, the data used for the analysis comes from two excellent sources: RansomLook.io, and ransomware.live. These sites continually search the internet and the dark web for threat actor claims of new victims, although it’s important to remember that the actual number of victims is likely to be significantly higher than those reported. Their data generally aligns, providing credibility to the numbers that we use.

Ransomware Victims Continue to Rise

As we saw last quarter, the number of victims claimed by ransomware extortion groups has continued to rise, as can be seen in Figure 1. The count peaked in August with an all-time high of around 1200.

Figure 1: Ransomware victims 2023-2026

The Evolution of the Ransomware Ecosystem

Every time a ransomware group disappears, two or three new ones seem to appear. Figure 2 shows the number of new ransomware groups appearing every month since January 2023. New groups present opportunities for new people to enter this area of online crime.

Figure 2: New ransomware groups 2023-2026

The number of active ransomware groups – those claiming at least one victim in any given month – has been unrelentingly increasing for years. Figure 3 tells the tale of this growth industry.

Figure 3: Active ransomware groups 2023-2026

More active ransomware groups introduces more criminals to the industry, and Q3 saw a new high-water mark in terms of active groups. This doesn’t bode well for the future.

Closing remarks

There’s little reason to expect the ransomware problem to improve anytime soon. The steady arrival of new groups, combined with a record number of active operators, suggests that ransomware remains an attractive and accessible criminal enterprise. Taking down one group may disrupt its operations, but it does little to address the conditions that allow others to take its place.

For defenders, that means there’s no finish line. The threat landscape will keep changing, new groups will emerge, and the next major incident may come from a direction few anticipated. The best response is to prepare for that uncertainty: reduce the opportunities attackers can exploit, maintain reliable backups, and make sure recovery plans work when they’re needed most.