Ransomware Victims Remain High as Active Groups Reach a New Peak in Q2 2026
Summary
Check Point Research reports 2,139 ransomware victims in Q2 2026, near Q1 levels, while active groups rose to 93. The top 10 groups’ share fell, and ransom payment rates continued a multiyear decline.
Key points
- Data leak sites recorded 2,139 victims in Q2, up 0.8% quarter over quarter and 33% year over year.
- Active ransomware groups increased from 71 to 93, while the top 10 groups’ share of victims fell from 71% to 57.6%.
- Qilin led with 279 victims for a fourth consecutive quarter; The Gentlemen reached 269 after a 62% increase and surpassed Qilin in June.
- A leak of The Gentlemen’s chat logs and platform data exposed details of its operations, including use of AI coding assistants to build its management panel.
- Ransom payment rates fell to about 23%, a six-year decline from 85% in 2019; on-chain payments still exceeded $820 million in 2025.
- Q2 law-enforcement actions targeted shared infrastructure used by ransomware actors, including laundering, malware-signing, infostealer, and VPN anonymization services.
- The US share of victims fell from 50% to 42%; the report also says vulnerabilities are being weaponized within hours to days of disclosure.
Article Details
- Publisher
- Check Point Research
- Report Period
- Q2 2026
- Scope
- Ransomware activity, victim counts, groups, payments, law-enforcement actions, and exploitation trends.
- Key Statistics
- Data leak sites recorded 2,139 victims in Q2 2026, up 0.8% from Q1 and 33% year over year.
- The top 10 groups accounted for 57.6% of victims, down from 71% in Q1; active groups increased from 71 to 93.
- Qilin reported 279 victims, down 17%; The Gentlemen reported 269, up 62%, and outpaced Qilin in June.
- The US share of victims fell from 50% to 42% quarter over quarter.
- Ransom payment rates were near 23%, compared with 85% in 2019; on-chain ransomware payments exceeded $820 million in 2025.
Threat Actors
KrybitNewly active group identified as among the fastest-growing; the report says it targeted the US less often than the ecosystem average.QilinRansomware operator; the report says it was the most prolific operator for a fourth straight quarter, with 279 victims.The GentlemenRansomware group; the report says it recorded 269 victims and outpaced Qilin during June.