Reviewed: September 8, 2026.
What happened
Comparitech recorded 997 ransomware incidents and criminal-group claims in August 2026, a 23% increase from July. The most important number is the smaller one: 77 incidents were confirmed by the organization involved, while 920 remained unconfirmed claims.
Among the 77 confirmed incidents, Comparitech counted 49 affecting businesses, 18 government entities, eight healthcare organizations, and two educational institutions. Its broader dataset also showed a 30% monthly increase in healthcare incidents and claims, while utility-sector activity doubled from five to 10.
What the numbers do—and do not—prove
Ransomware leak sites are useful warning signals, but the criminals running them are not neutral sources. An unconfirmed listing can represent a real intrusion that has not been disclosed, an older incident, a misidentified target, or a false claim. Comparitech marks a case as confirmed only when the target publicly reports ransomware or acknowledges a cyberattack that aligns with a group's claim.
Why it matters: The volume signals persistent attacker activity, but organizations should not repeat every leak-site post as a verified breach. Separate the claim, the confirmed incident, and the measured impact.
What to do now
- Identify internet-facing remote-access, management, and file-transfer systems; patch known weaknesses and remove access that is no longer needed.
- Require multifactor authentication for remote and administrative access, then review dormant accounts and excessive privileges.
- Keep isolated backups and test a real restoration so recovery time and missing dependencies are known before an incident.
- Segment critical systems and restrict lateral movement between ordinary user devices, servers, backups, and administrative tools.
- Centralize logs, preserve incident evidence, and maintain an offline contact list for leadership, legal counsel, insurers, responders, and law enforcement.
- Use a written response plan for containment, notification, and recovery. Do not improvise a ransom decision during the crisis.
Data and methodology: Comparitech ransomware roundup, updated September 8, 2026
Official resource: CISA StopRansomware Guide
Panther Note
A ransomware group's claim is a lead, not a verdict. Verify the evidence, prepare for disruption, and make recovery something the organization has practiced—not something it discovers under pressure.