Ransomware Hits 2026 Peak in August; India Leads Asia-Pacific

August was the busiest ransomware month of 2026

The data from ransomware leak sites for August 2026 points one way. Criminal groups named more victims that month than in any other month this year, and India came out as the most frequently claimed target in Asia-Pacific.

The headline numbers come from The Ransomware Brief by Cyble Research and Intelligence Labs (CRIL). It counted 1,034 organisations publicly named as victims worldwide in August, posted by 88 ransomware gangs. That works out to about 33 new victims a day.1218 The total also ends a slide. Victim counts fell for three straight months from March to June, then rose 60% in July and another 25% in August.1113

India had 24 claimed victims. That puts it seventh in the world and first among Asia-Pacific countries.1113 It also means Indian organisations made up nearly one in six of the 143 victims claimed across the region.16

Different trackers, different counts, same direction

Ransomware statistics depend on who is counting, and August shows how far the figures can drift apart. Breachsense counted 964 victims for the month. That was up 19% from July's 811 and well above any earlier month this year. It puts the year-to-date total at 6,065, about 25% ahead of 2025's pace.1 The live tracker Ransomtracker shows a higher August figure, about 1,223 listings. It reports 8,670 victims so far in 2026 as of mid-October.8

The trackers also disagree on which group led the month. Cyble credits Qilin with 147 victims15, although a summary of the same brief elsewhere gives 14518. Breachsense puts Qilin at 157, its best month of the year, with The Gentlemen second at 127.1 There are small inconsistencies inside Cyble's own reporting as well. One summary says 88 groups were active, while another says 96 gangs posted claims.1518 The coverage also disagrees on second place in the region. Some outlets have Thailand at 17 and Taiwan at 161516, while another has the two tied at 16.18

None of this undermines the main finding. Each tracker scrapes and removes duplicates from criminal leak sites in its own way. One analyst warns that these counts record claims, not confirmed incidents. Some victims never appear on a leak site, and some listings are inflated or duplicated.20 So the numbers should be read as a measure of where attackers are focusing, not a full census. On that reading, every dataset shows a large rise in August.

A second dataset reaches a similar conclusion on India

Separate research from Group-IB supports the regional picture, though with different numbers. Group-IB recorded 190 ransomware incidents across Asia-Pacific in August, up 26.7% from July.19 One breakdown of that data says India led with 32 incidents, ahead of Australia with 24 and Taiwan with 20.20 Group-IB also counted 182 Indian incidents across all of its threat categories. That figure includes data leaks and hacktivism, so it should not be read as 182 ransomware attacks.19

Two firms with different methods both placing India first is the strongest signal in the coverage. Earlier Group-IB data also shows that monthly rankings move around. Australia, for example, was the region's most targeted ransomware country in May.19 One month at the top is not a trend on its own. What the reporting does support is that India is now a regular, high-value target.

Why India and why these sectors

Cyble's sector numbers explain much of India's position. Manufacturing was the most hit sector globally with 151 victims. Professional services followed with 147, IT and IT-enabled services with 126, and healthcare with 98.1113 CRIL says these industries share two weaknesses. Downtime is very costly for them, and they hold sensitive client data that raises the pressure to pay. India's large IT services and manufacturing base is exposed on both counts.1213

Daksh Nakra, Cyble's senior manager of research and intelligence, said India topping the region shows attackers consider Indian organisations worth the effort.15 Group-IB's data also has manufacturing as the most affected sector in Asia-Pacific, with 38 ransomware events.19 When two firms reach the same sector finding, it is harder to dismiss as an artefact of one company's method.

Asia-Pacific has its own ransomware leaders

The most useful threat-intelligence point in the August data is that Asia-Pacific does not follow the global pattern. Qilin, the world's most active gang, led every region except Asia-Pacific. There, The Gentlemen claimed 20 victims to Qilin's 16.14 Two regional groups, Krybit with 13 victims and orova with 12, together claimed more Asia-Pacific victims than Qilin. Neither is in the global top five.15

Group-IB's numbers point the same way. It linked The Gentlemen to 37 leak events in the region and recorded a 230% month-on-month jump in Krybit activity, to 33 events.19 Weekly tracking from Ransom-DB also put orova near the top worldwide in mid-August, with 35 victims in one week, behind The Gentlemen and Qilin.6

CRIL argues that global threat models and vendor coverage built around well-known groups tend to underweight regional specialists like these.15 That argument holds up. Security teams in India often take their priorities from Western threat reports, which are dominated by US victims. The US accounted for 484 victims, or 48% of the global total, nearly ten times second-placed Italy.14 A defensive plan built around the groups that matter in North America may miss the ones actually hitting Indian companies. Nakra summed it up: Indian security teams should plan around the groups active in their region and close old gaps before chasing new threats.16

How attackers are getting in

The intrusion methods are routine and well known. Cyble highlighted a campaign by Cl0p affiliates exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, product lifecycle software used by manufacturers and engineering firms. Instead of encrypting systems, the attackers steal blueprints, CAD files and supply-chain data. That lets them avoid endpoint tools tuned to spot encryption behaviour. More than 40 organisations have been publicly named.15

The other access routes are old vulnerabilities. Cyble pointed to the Akira group using a two-year-old SonicWall SSL VPN flaw, CVE-2024-40766, and Gunra affiliates using Fortinet FortiOS vulnerabilities.15 Weekly intelligence from mid-August describes the same pattern. Akira's SonicWall campaign was traced partly to migrated local accounts whose passwords were never reset after upgrades. A FortiGate authentication bypass was named as a main Gunra entry point in a CISA advisory. Another FortiOS flaw was still giving Qilin access two years after it was patched.3

CRIL attributes the August surge to affiliate recruitment and attacks on internet-facing infrastructure, not to any new encryption capability. It also notes that some gangs now extort victims through data theft alone, and that AI is helping attackers move faster.18 Qilin shows why this model is hard to stop. Its intrusions are carried out by affiliates recruited on Russian-language forums. As of August, no government had publicly named, charged or sanctioned anyone behind it, even after the group listed the US Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site.2

What it means

The most important claim in Cyble's brief may be about forecasting, not August itself. CRIL treats the August volume as a new baseline rather than a seasonal spike. It warns that security plans based on first-half 2026 volumes are now about 41% below actual activity.18 Nakra said the quieter first half of the year did not mean ransomware was fading. In his view, the gangs were regrouping.18 Breachsense's projection of about 9,100 victims for the full year, roughly 25% above 2025, supports that view.1

One caution: October tracking suggests some cooling. Ransomtracker shows Qilin's 30-day count dropping from 113 to 86.8 Even so, a group losing ground in one month says little when dozens of other operators are ready to take its affiliates.

The recommendations are not new, but the August data adds urgency. The brief calls for patching internet-facing systems in order of risk, phishing-resistant MFA extended to third parties, network segmentation to limit data theft, tested offline backups, and monitoring of leak sites and access markets.18 For Indian manufacturers and IT services firms, the August figures suggest two-year-old VPN flaws and lesser-known regional gangs are a more immediate risk than the next headline zero-day.