Ransomware August 2026: Cloud Identity Gaps Fuel a Record Month

A record month, by any count

August 2026 was one of the worst months on record for ransomware. Different trackers produced different totals, but they agree on the direction.

NCC Group counted 1,073 attacks worldwide, up 12% from 960 in July, which makes August the highest monthly figure it has recorded this year 14. Comparitech reported a lower total of 997 attacks, about 32 per day. That figure is up 23% from 809 in July and beats the previous monthly record of 988, set in February 2025 2.

The gap of roughly 76 attacks between the two counts is not surprising. NCC Group builds its numbers from leak-site postings, victim notifications and its own incident response work 4. Comparitech uses its own method, and each approach catches a somewhat different set of incidents. The useful signal is that both counts point the same way, and both show a jump of double digits in a single month.

Who got hit

NCC Group found that industrial organizations absorbed the most attacks: 329 incidents, or 31% of its total 1. That works out to roughly one in three attacks 4. Geographically, North America took 473 attacks (44%) and Europe took 276 (26%) 1.

Comparitech's sector breakdown is drawn differently but tells a similar story:

• Businesses: 861 attacks, up 24% month over month.
• Healthcare: 69 attacks, up 30%.
• Utilities: 10 attacks, double July's five 2.

The utility figure is small in absolute terms. Doubling in one month still matters when the targets run critical infrastructure.

The groups behind it

Both trackers name Qilin as August's most active operator. NCC Group says Qilin overtook The Gentlemen and accounted for 15% of recorded attacks 1. Comparitech attributes 157 incidents to Qilin, a 22% increase, and 107 to The Gentlemen, a 21% decline 2. Together the two groups accounted for more than a quarter of the month's attacks 2.

The smaller players are worth watching too. NCC Group's incident responders examined Aurora, an emerging group that broke in through VPN exploitation and credential harvesting and hit organizations across several sectors 1. Separately, the DeadLock operation has been using blockchain infrastructure to resist takedowns. Its leak site lists around 80 victims, mostly in Europe 3. If that approach spreads, law enforcement disruption, already one of defenders' slower tools, gets harder still.

The quieter shift: identity as the way in

The headline numbers attract attention, but the more lasting story may be about how attackers get in. NCC Group notes that operators keep relying on established intrusion methods while leaning more on data extortion 1. Reporting on the same data also points to new tactics built around cloud identity 4.

A broader review of August's breaches points the same way. Weaknesses in third-party platforms, identity systems and cloud environments repeatedly gave attackers access to valuable data 3. That review identifies compromised credentials and excessive permissions as the openings attackers look for, and it treats identity and access security as a primary line of defense 3.

Taken together, this suggests a reframing. Ransomware volume is rising, but volume is a symptom. The underlying exposure is the sprawl of identities, service accounts and permissions that organizations have built up as they moved onto cloud and SaaS platforms. Aurora's playbook depends on harvested credentials rather than novel exploits 1. An over-permissioned account turns one stolen password into broad access, and data extortion lets attackers profit without ever encrypting a file.

What to make of it

NCC Group has described 2026 ransomware activity as range-bound but elevated 4. August is better read as a high point within a sustained plateau than as a sudden break. That framing cuts both ways. It argues against panic over a single month's spike. It also means the elevated baseline is now the normal state.

For defenders, the sources suggest priorities that are less about blocking any single group and more about shrinking what a compromised identity can reach:

• Audit cloud permissions to remove access accounts don't need.
• Harden VPN and remote-access endpoints, the entry point in Aurora's attacks 1.
• Scrutinize third-party access, which the August breach review flags as a recurring weakness 3.

Industrial firms and utilities have a particular reason to act. They combine heavy targeting with operational stakes that make extortion pressure especially effective 12.

The monthly totals will keep fluctuating, and trackers will keep disagreeing on exact figures. The trend the reporting converges on is clear: attackers increasingly exploit the access that organizations have granted, not just the vulnerabilities they have missed.