Ransomware Attacks Spike 20% in July While AI Steals the Headlines

Share

Ransomware attacks jumped nearly 20 per cent in July while the security industry’s attention was fixed on artificial intelligence. UK research firm Comparitech counted 799 ransomware incidents during the month, up from 668 in June. Of those, 51 had been confirmed by victims. The tally makes July the second busiest month of 2026 for ransomware, just behind March, when the firm recorded 805 attacks.

What the Data Shows

The headline figure is only part of the story. The distribution of attacks changed sharply in July. Ransomware incidents against utility companies fell 44 per cent, and attacks on legal firms and government agencies dropped 31 per cent and 11 per cent respectively. Those sectors were not the ones that suffered.

The sectors that saw the steepest increases were:

• Finance companies, up 71 per cent
• Technology firms, up 62 per cent
• Pharmaceutical companies and medical billers, up 46 per cent
• Education, up 44 per cent

The United States remained the most targeted country, absorbing 322 of the 799 attacks. Germany was second with just 40.

Why These Sectors Pay

The pattern is not random. Penetration testing firm DeepStrike reported that manufacturing, education, healthcare and financial services firms are the most likely to pay a ransom. Even the least likely of those groups, finance, still pays in 51 per cent of cases. For an attacker optimising for return on effort, that is a powerful incentive.

These organisations share a common pressure: downtime is expensive, data is sensitive, and regulatory or operational consequences make restoration urgent. That urgency is what ransomware crews monetise.

The Gangs Behind the Spike

Two groups dominated July. The Gentlemen, a relatively new operation that earlier this year claimed an attack on UK software consultancy Adaptavist Group, led the month with 135 claimed victims. Qilin, the crew behind the 2024 Synnovis breach that disrupted NHS services, claimed 125. Between them they accounted for nearly 33 per cent of logged attacks.

Their methods are familiar. Trend Micro has described The Gentlemen using stolen credentials. Qilin has told The Register it abused zero-day vulnerabilities to break into Synnovis. Both routes, credential abuse and unpatched software, exploit the same underlying condition: data and systems that remain continuously connected.

The AI Distraction

The timing matters. July was the month security headlines were dominated by agentic AI, model escapes and speculation about autonomous malware. The Register’s report frames the spike as a reminder that while attention drifts toward emerging threats, the old ones do not pause.

Boards and security teams are right to think about AI risk. But AI-enabled attacks are not yet the main source of damage. Ransomware is. And ransomware’s success still depends on the same controls it always has: exposed credentials, missing patches, flat networks and backups that live online.

The Firevault View

There is a structural reason ransomware keeps working. Most organisations defend the connection rather than questioning whether the connection should exist at all. Every live copy of critical data is a target that can be encrypted, exfiltrated or held hostage. Every always-on system is a beachhead waiting for the right credential or exploit.

Offline Secure Storage® changes the equation. By holding verified gold copies of critical data on hardware that is physically disconnected when not in active use, it removes the attack surface rather than merely hardening it. A ransomware operator cannot encrypt a copy that is not connected. They cannot exfiltrate data that has no network interface. Recovery starts from a known-good physical state, not from a negotiation.

For the sectors hit hardest in July, finance, technology, pharmaceuticals, medical billing and education, the principle is the same. Crown jewel records, research archives, patient data, regulatory files and financial ledgers do not need to be online twenty-four hours a day to be valuable. They need to be available when required and unreachable the rest of the time.

Conclusion

The July spike is a correction. It reminds us that ransomware remains the most immediate, measurable and financially motivated cyber threat facing organisations today. AI may reshape the threat landscape, but the present landscape is still dominated by crews who break in, encrypt data and demand payment.

The practical response has not changed: multi-factor authentication, timely patching, tested backups and a deliberate decision about which data must remain connected. For the data that does not need to be connected, Offline Secure Storage® offers a way to take it permanently off the board.

How Firevault would handle this

Physical disconnection removes the path an attacker needs

Offline Secure Storage® holds a clean copy of your data on hardware that is physically disconnected, so an intrusion cannot reach it, encrypt it or delete it.