--- title: "Ransomware Attacks Spike 20% in July While AI S… | Firevault" url: https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction description: "Ransomware attacks jumped nearly 20 per cent in July, with 799 incidents logged globally. While AI dominates security headlines, finance, technology,…" lang: en-GB --- News · Breach Analysis · 12 August 2026 # Ransomware Attacks Spike 20% in July While AI Steals the Headlines Ransomware attacks jumped nearly 20 per cent in July, with 799 incidents logged globally. While AI dominates security headlines, finance, technology, pharmaceutical, medical billing and education organisations absorbed the sharpest increases. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fransomware-attacks-spike-july-2026-ai-distraction Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fransomware-attacks-spike-july-2026-ai-distraction&text=Ransomware%20Attacks%20Spike%2020%25%20in%20July%20While%20AI%20Steals%20the%20Headlines%0A%0ARansomware%20attacks%20jumped%20nearly%2020%20per%20cent%20in%20July%2C%20with%20799%20incidents%20logged%20globally.%20While%20AI%20dominates%20security%20headlines%2C%20finance%2C%20technology%2C%20pharmaceutical%2C%20medical%20billing%20and%20education%20organisations%20absorbed%20the%20sharpest%20increases. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fransomware-attacks-spike-july-2026-ai-distraction Image: Abstract illustration showing a ransomware lock symbol and AI neural network separated by a physical gap, in navy, magenta and cyan (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg) Abstract illustration showing a ransomware lock symbol and AI neural network separated by a physical gap, in navy, magenta and cyan Why it matters ## What this means for organisations holding critical data **Ransomware attacks jumped nearly 20 per cent in July while the security industry’s attention was fixed on artificial intelligence.** UK research firm Comparitech counted 799 ransomware incidents (https://www.comparitech.com/blog/security/ransomware-statistics/) during the month, up from 668 in June. Of those, 51 had been confirmed by victims. The tally makes July the second busiest month of 2026 for ransomware, just behind March, when the firm recorded 805 attacks. ## What the Data Shows The headline figure is only part of the story. The distribution of attacks changed sharply in July. Ransomware incidents against utility companies fell 44 per cent, and attacks on legal firms and government agencies dropped 31 per cent and 11 per cent respectively. Those sectors were not the ones that suffered. The sectors that saw the steepest increases were: - Finance companies, up 71 per cent - Technology firms, up 62 per cent - Pharmaceutical companies and medical billers, up 46 per cent - Education, up 44 per cent The United States remained the most targeted country, absorbing 322 of the 799 attacks. Germany was second with just 40. ## Why These Sectors Pay The pattern is not random. Penetration testing firm DeepStrike reported (https://deepstrike.io/blog/ransomware-payout-statistics-2025) that manufacturing, education, healthcare and financial services firms are the most likely to pay a ransom. Even the least likely of those groups, finance, still pays in 51 per cent of cases. For an attacker optimising for return on effort, that is a powerful incentive. These organisations share a common pressure: downtime is expensive, data is sensitive, and regulatory or operational consequences make restoration urgent. That urgency is what ransomware crews monetise. ## The Gangs Behind the Spike Two groups dominated July. The Gentlemen, a relatively new operation that earlier this year claimed an attack on UK software consultancy Adaptavist Group, led the month with 135 claimed victims. Qilin, the crew behind the 2024 Synnovis breach (https://www.theregister.com/cyber-crime/2026/06/09/qilin-nhs-breach-tally-grows-as-essex-trust-confirms-stolen-records/5252663) that disrupted NHS services, claimed 125. Between them they accounted for nearly 33 per cent of logged attacks. Their methods are familiar. Trend Micro has described (https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html) The Gentlemen using stolen credentials. Qilin has told (https://www.theregister.com/security/2024/06/20/qilin-has-no-regrets-over-the-healthcare-crisis-it-caused/304556) The Register it abused zero-day vulnerabilities to break into Synnovis. Both routes, credential abuse and unpatched software, exploit the same underlying condition: data and systems that remain continuously connected. ## The AI Distraction The timing matters. July was the month security headlines were dominated by agentic AI, model escapes and speculation about autonomous malware. The Register’s report frames the spike as a reminder that while attention drifts toward emerging threats, the old ones do not pause. Boards and security teams are right to think about AI risk. But AI-enabled attacks are not yet the main source of damage. Ransomware is. And ransomware’s success still depends on the same controls it always has: exposed credentials, missing patches, flat networks and backups that live online. ## The Firevault View There is a structural reason ransomware keeps working. Most organisations defend the connection rather than questioning whether the connection should exist at all. Every live copy of critical data is a target that can be encrypted, exfiltrated or held hostage. Every always-on system is a beachhead waiting for the right credential or exploit. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® changes the equation. By holding verified gold copies of critical data on hardware that is physically disconnected when not in active use, it removes the attack surface rather than merely hardening it. A ransomware operator cannot encrypt a copy that is not connected. They cannot exfiltrate data that has no network interface. Recovery starts from a known-good physical state, not from a negotiation. For the sectors hit hardest in July, finance, technology, pharmaceuticals, medical billing and education, the principle is the same. Crown jewel records, research archives, patient data, regulatory files and financial ledgers do not need to be online twenty-four hours a day to be valuable. They need to be available when required and unreachable the rest of the time. ## Conclusion The July spike is a correction. It reminds us that ransomware remains the most immediate, measurable and financially motivated cyber threat facing organisations today. AI may reshape the threat landscape, but the present landscape is still dominated by crews who break in, encrypt data and demand payment. The practical response has not changed: multi-factor authentication, timely patching, tested backups and a deliberate decision about which data must remain connected. For the data that does not need to be connected, Offline Secure Storage® offers a way to take it permanently off the board. Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis View original article (https://www.theregister.com/security/2026/08/07/ransomware-attacks-spike-as-world-distracted-by-ai/5284934) About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction#webpage", "url": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction", "name": "Ransomware Attacks Spike 20% in July While AI S…", "description": "Ransomware attacks jumped nearly 20 per cent in July, with 799 incidents logged globally. While AI dominates security headlines, finance, technology,…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Ransomware Attacks Spike 20% in July While AI Steals the Headlines", "item": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Ransomware Attacks Spike 20% in July While AI Steals the Headlines", "description": "Ransomware attacks jumped nearly 20 per cent in July, with 799 incidents logged globally. While AI dominates security headlines, finance, technology, pharmaceutical, medical billing and education organisations absorbed the sharpest increases.", "url": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fransomware-spike-ai-distraction.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-12T17:52:00+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/ransomware-attacks-spike-july-2026-ai-distraction" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 731, "keywords": "Ransomware, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap, ransomware attacks July 2026, Comparitech ransomware statistics, The Gentlemen ransomware group, Qilin ransomware, AI distraction cybersecurity, finance sector ransomware, education ransomware, pharmaceutical ransomware, medical billing ransomware, ransomware resilience, offline secure storage ransomware protection, physical air gap backup", "articleBody": "Ransomware attacks jumped nearly 20 per cent in July while the security industry’s attention was fixed on artificial intelligence. UK research firm Comparitech counted 799 ransomware incidents during the month, up from 668 in June. Of those, 51 had been confirmed by victims. The tally makes July the second busiest month of 2026 for ransomware, just behind March, when the firm recorded 805 attacks.", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] ```