Ransomware hit a record high in Q3, even as fewer victims paid.
GRIT tracked 2,760 ransomware victims in Q3 2026. That’s more than in any previous quarter and up 75% from a year ago. Payment rates fell by more than half, but the attacks kept coming from more groups and in more countries.
Watch GuidePoint Security’s Research and Intelligence Team (GRIT) as the report’s authors break down what’s driving the surge, how threat actor tactics are changing and what it all means for defenders.
What we cover:
- Why volume works: How the affiliate model is lowering the barrier to entry
- A new group at the top: The group that narrowly overtook Qilin
- The payment paradox: Why the average payment rose with fewer payouts
- Beyond encryption: The rise of ShinyHunters
- AI and the shrinking attack window
- Where attacks are landing: Industries and regions being hit hardest and a sector returning to the top 10
Speakers:
- Jason Baker, Practice Lead – Threat Intelligence (GRIT)
- Grayson North, Principal Threat Intelligence Consultant
- Justin Timothy, Principal Threat Intelligence Consultant
- Nick Hyatt, Principal Threat Intelligence Consultant
