Ransomware Attacks August 2026: Two Trackers, Two Counts

Two counts, one direction

Ransomware activity climbed sharply in August 2026, according to two separate tracking efforts. They agree on the trend but not on the size of the problem.

NCC Group recorded 1,073 ransomware attacks worldwide in August, a 12% rise from 960 in July. It called this the highest monthly total of 2026 so far. 13 Comparitech counted 997 attacks for the same month, or about 32 per day. That is a 23% jump from the 809 it logged in July. 2 Comparitech describes 997 as an all-time monthly record, just above the previous peak of 988 set in February 2025. 2

So the firm reporting a "record" has the lower number, while the firm with the higher number frames August as a 2026 high rather than a historic one. The July baselines differ too: 960 for NCC versus 809 for Comparitech. That gap explains why one tracker sees 12% growth and the other nearly double that. 12

NCC's own framing has some nuance. One account notes the firm has described 2026 ransomware activity as "range-bound but elevated." On that reading, August is one of the higher months in a persistently high year, not a break from it. 3

Why the numbers diverge

The trackers are not measuring quite the same thing. NCC Group builds its monthly figures from several inputs, including leak-site postings, victim notifications and its own incident response engagements. 3 Comparitech's breakdowns repeatedly refer to "confirmed" incidents. 2 The wording suggests it applies a stricter verification standard, at least for some categories.

The clearest sign of this is in the sector data. NCC put industrials at the top of its list with 329 attacks, or 31% of the total. 13 Comparitech reported just 12 confirmed attacks on manufacturers, though that figure was still up 23% month over month. 2

Some of that gap likely comes from definitions. "Industrials" is a broader category than "manufacturers." But a difference of more than an order of magnitude points to deeper methodological differences. These would include what counts as an attack, how leak-site claims are verified, and how victims are assigned to sectors.

This matters because monthly ransomware tallies are widely quoted by vendors, policymakers and boards as if they were precise measurements. They are better understood as estimates shaped by each tracker's sources and rules. Even the direction of travel can depend on which baseline a reader picks.

What both trackers agree on

The two datasets differ in emphasis but overlap in substance.

Victims are broad and rising.

• Comparitech found businesses accounted for 861 attacks, up 24% from July. 2
• Healthcare incidents rose 30% to 69. 2
• Attacks on utilities doubled from five to ten. 2
• Retail attacks increased 30%. 2

Geography is concentrated. NCC's data shows North America absorbing 473 attacks (44%) and Europe 276 (26%). 1

Group dynamics are shifting.

• NCC reported that Qilin overtook The Gentlemen as the most active group, responsible for 15% of attacks. 1
• Comparitech highlighted Clop, which added 45 victims to its leak site in August compared with a single victim in July. 2 Clop has historically posted victims in batches, so a jump like this is consistent with that pattern, though the month's data alone doesn't confirm it.

Tactics are familiar but evolving.

• NCC says operators continue to lean on proven intrusion methods while expanding data extortion. 1
• Its incident response team examined an emerging group called Aurora, which used VPN exploitation and credential harvesting against organizations across multiple sectors. 1
• Coverage of the same report also points to newer techniques aimed at cloud identity. 3

The reading

The headline numbers should be treated with caution, but the signal underneath them looks real. Two independent trackers with different methods and different baselines both saw double-digit monthly growth in August. Both point to more attacks on essential services such as healthcare and utilities. When methodologies disagree on the magnitude but agree on the direction, the direction is the more trustworthy finding.

For defenders, the details are more useful than the totals. The routes in are well known: exposed VPNs and stolen credentials. Extortion that skips encryption and relies on stolen data is spreading. Identity systems, including cloud identity, are becoming a larger part of the attack surface. 13 None of that depends on whether August had 997 attacks or 1,073.

For anyone citing these figures, the lesson is to name the source and its method. Avoid treating any single tracker's count as the definitive measure of the ransomware economy.