Ransomware surges while AI dominates the conversation
Ransomware attacks rose 20 per cent in July 2026 to 799 confirmed incidents, according to Comparitech data reported by The Register. Finance, technology, pharmaceuticals and education absorbed the sharpest increases while attention stayed fixed on artificial intelligence.
Article record
Why it matters
What this means for organisations holding critical data
Ransomware attacks rose 20 per cent in July 2026 to 799 confirmed incidents, according to Comparitech data reported by The Register. Finance, technology, pharmaceuticals and education absorbed the sharpest increases while attention stayed fixed on artificial intelligence.
The Register has published figures that deserve a careful read. Ransomware groups are not slowing down. They are changing targets, and they are doing so while the board level conversation is dominated by artificial intelligence.
What the data shows
New data from Comparitech for July 2026 records 799 ransomware attacks, up 20 per cent from 668 in June. That makes July the second busiest month of the year so far, just behind March with 805 attacks. Only 51 of those victims were confirmed publicly, which tells you how much of this activity never reaches a headline.
Where the pressure moved
The sector movements are the most revealing part of the picture:
- Finance, up 71 per cent
- Technology, up 62 per cent
- Pharmaceuticals and medical billing, up 46 per cent
- Education, up 44 per cent
This is not random. Groups are measuring the probability of getting paid. They are going after organisations with healthy margins, sensitive records and low tolerance for downtime, in industries the rest of us depend upon.
Who is behind the surge
Two names account for roughly a third of all claimed attacks in the month. The Gentlemen claimed 135 victims. Qilin claimed 125 victims. A small number of well organised operations continue to carry a disproportionate share of the harm.
The artificial intelligence distraction
Artificial intelligence is not the threat story here, but it is the reason the threat story is being missed. While strategy time is spent on model adoption and governance, ransomware crews are running the same playbook they have always run, only more efficiently, with artificial intelligence assisting reconnaissance, phishing quality and negotiation pressure. The tactics have not changed. The throughput has.
The Firevault view
Every one of these incidents depends on the same assumption: that the attacker can reach the data. Connected backup platforms, replicated cloud copies and always on file shares are all reachable, which is exactly why they are encrypted or deleted before the ransom note lands.
Offline Secure Storage® (#OSS) removes that assumption. Data held in a Firevault Vault sits on physically disconnected storage inside a secure bunker. It is not on a network path, so it cannot be enumerated, encrypted or exfiltrated during an intrusion. Access is enabled deliberately by the customer, then removed again. When a finance firm, a technology business, a pharmaceutical supplier or a university is hit, the question that decides the outcome is simple: is there a clean copy the attacker could never touch?
Boards should keep the artificial intelligence agenda. They should also confirm, this quarter, that a recovery position exists which does not rely on anything being online.
Source: The Register, Ransomware attacks spike as world distracted by AI, drawing on the Comparitech ransomware roundup for July 2026.
How Firevault would handle this
Physical disconnection removes the path an attacker needs
Offline Secure Storage® holds a clean copy of your data on hardware that is physically disconnected, so an intrusion cannot reach it, encrypt it or delete it.
Related Reading
You may also find these useful
Shell investigates Cl0p data theft claim as engineering files are listed
Shell has opened an investigation after the Cl0p ransomware group claimed the theft of around 89 gigabytes of internal data, said to include engineering drawings, facility photographs, project roadmaps and testing reports. Shell is one of dozens of organisations named in the same campaign.
Gunra ransomware hits critical infrastructure via Fortinet flaws
CISA, the FBI, the NSA and partner agencies have warned that Gunra ransomware affiliates are exploiting known Fortinet authentication bypass flaws to reach critical infrastructure networks, then stealing and encrypting data.
Alarm Raised: UK Healthcare Sees Tenfold Rise in Cyber-Attacks in Early 2026
SonicWall recorded 264,000 attack events across UK healthcare in the first five months of 2026, nearly ten times the total for all of 2025. Legacy Java middleware, unpatched patient portals and internet-exposed load balancers are being stress-tested to breaking point.
The worst-kept secret in AI: every frontier model has gone rogue
The AISI Frontier AI Trends Report and OpenAI's live sandbox escape have finally put numbers behind what researchers, regulators and lab leaders have been saying for two years. Frontier models can be jailbroken, agents can escape, and containment is an open engineering problem. A Firevault synthesis of the evidence, the industry chorus, and what UK policy should now require.
Employment Documentation Is a Breach Readiness Control
Breach readiness does not start with the alert. It starts in the employment contract, the staff handbook and the policies that tell people what they are responsible for. Mark Fermor on why vague duties become the firm's problem.
Iranian state hackers targeting OT: why offline golden copies decide the recovery
A new Congressional Research Service report names Iran alongside China, Russia and North Korea as a leading cyber adversary, with operations now reaching deep into industrial control systems. The recovery problem is no longer about backups. It is about whether your golden copies are reachable by the attacker.
Share this article
Ransomware surges while AI dominates the conversation
Ransomware attacks rose 20 per cent in July 2026 to 799 confirmed incidents, according to Comparitech data reported by The Register. Finance, technology, pharmaceuticals and education absorbed the sharpest increases while attention stayed fixed on artificial intelligence.
