The State of Ransomware Q2 2026 

More groups. Fewer payments. Ransomware keeps evolving.

The State of Ransomware Q2 2026 is Check Point Research's ongoing analysis of the global ransomware threat landscape, tracking how attacker structure, access patterns, economics, and law enforcement pressure are shifting quarter over quarter. 
This quarter's data points to a more nuanced picture than concentration alone: 
  • Victim volume held at its elevated 2025 baseline, with 2,139 organizations listed on data leak sites 
  • The top 10 groups still account for well over half of all reported attacks 
  • The number of active groups climbed to a new high of 93 
  • The leaked chats from The Gentlemen operation revealed how little it now takes to build a top three ransomware business 

Heading 1

keyboard

Heading 2

keyboard

Heading 3

keyboard

Report Key Takeaways

2,139 Victims Recorded in Q2 2026

Data leak site activity stayed essentially flat compared with Q1 and climbed 33% year over year, confirming ransomware remains a sustained operational risk rather than a passing spike. 




Top 10 Groups Share Eased to 57.6% 

Down from 71% in Q1, while the number of active operators climbed from 71 to 93, showing a ransomware landscape that is becoming increasingly fragmented even as leading groups maintain their positions. 


The Gentlemen's Leaked Chats, Exposed 

An internal leak revealed a core team of roughly nine operators running a top three global operation, built with AI assisted tooling and a broader affiliate network supporting it at scale. 


Payment Rates Hit a Multi Year Low 

Ransom payment rates fell to about 23%, down from 85% in 2019, pushing operators toward data theft extortion, even as on chain ransomware payments still exceeded $820 million in 2025. 


Live-Session  The State of Ransomware Q2 2026: This Quarter's Trends, and Their Impact on Your Defenses 

The ransomware ecosystem widened this quarter, yet the same names held the top. A leaked backend from one of them just showed how little it now takes to get there. 
On August 25th, Check Point Research will present the key findings from the Q2 2026 report, followed by a practical discussion on what this means for your defenses. 
What you'll walk away with: 
  • How a small core team built a top three ransomware operation in months, using AI assisted tooling and pre positioned access 
  • Why falling payment rates are pushing attackers toward data theft extortion 
  • Which shared infrastructure law enforcement is targeting, and why it raises costs across multiple groups at once 
  • Practical steps to reduce exposure across the attack lifecycle, from initial access to lateral movement and blast radius 
Register Here

Additional Resources

Explore Past Reports

The State of Ransomware Q1 2026 

Ready to Strengthen Your Defenses?

You've come to the right place. Connect with one of our cyber security experts now.
Talk to an Expert

Report | AI Security, 2026

Explore the 2026 AI Security Report to uncover emerging AI-powered cyber threats, real-world attack trends, and expert recommendations to help secure your organization in the age of AI.

Report | The State of Ransomware, Q2 2026

Explore the Q2 2026 State of Ransomware Report to uncover key ransomware trends, leading threat groups, AI-driven attacks, victim data, and defense strategies.