The State of Ransomware Q2 2026 

The State of Ransomware Q2 2026 is Check Point Research's ongoing analysis of the global ransomware threat landscape, tracking how attacker structure, access patterns, economics, and law enforcement pressure are shifting quarter over quarter. 
This quarter's data points to a more nuanced picture than concentration alone: 

• Victim volume held at its elevated 2025 baseline, with 2,139 organizations listed on data leak sites 
• The top 10 groups still account for well over half of all reported attacks 
• The number of active groups climbed to a new high of 93 
• The leaked chats from The Gentlemen operation revealed how little it now takes to build a top three ransomware business 

Heading 1

Heading 2

Heading 3

Report Key Takeaways

2,139 Victims Recorded in Q2 2026

Data leak site activity stayed essentially flat compared with Q1 and climbed 33% year over year, confirming ransomware remains a sustained operational risk rather than a passing spike. 

Top 10 Groups Share Eased to 57.6% 

Down from 71% in Q1, while the number of active operators climbed from 71 to 93, showing a ransomware landscape that is becoming increasingly fragmented even as leading groups maintain their positions. 

The Gentlemen's Leaked Chats, Exposed 

An internal leak revealed a core team of roughly nine operators running a top three global operation, built with AI assisted tooling and a broader affiliate network supporting it at scale. 

Payment Rates Hit a Multi Year Low 

Ransom payment rates fell to about 23%, down from 85% in 2019, pushing operators toward data theft extortion, even as on chain ransomware payments still exceeded $820 million in 2025. 

Additional Resources

Explore Past Reports

The State of Ransomware Q1 2026 

Ready to Strengthen Your Defenses?