Ransomware Attacks Surge in July 2026, Hitting Finance, Tech, and Healthcare Hard
July 2026 marked a sharp rise in ransomware activity, recording 799 claimed attacks the second-highest month of the year and the third-highest in the past 17 months, according to Comparitech. The 19% increase from June targeted critical sectors, with finance (up 71%), technology (62%), healthcare (46%), and education (44%) experiencing the most significant spikes.
U.S.-based organizations bore the brunt of the surge, facing a 31% increase in attacks compared to June. Among the most disruptive incidents was an attack on U.S. healthcare provider AnMad, forcing facility closures, and a strike on Romania’s land registry agency, which wiped an entire database and disrupted the country’s real estate market.
Two ransomware groups dominated July’s activity: The Gentlemen (135 attacks) and Qilin (125 attacks), together accounting for 33% of all incidents. Their rivalry for dominance continued, with The Gentlemen surpassing Qilin as the most prolific threat actor earlier in 2026. Other active groups included DragonForce (41 attacks), INC (36), CRPx0 (33), and SafePay (30).
The attacks underscored evolving tactics, from system takedowns to data theft and outright deletion, reinforcing the need for robust backup strategies. Comparitech’s analysis, published on August 5, highlighted the persistent and escalating threat posed by ransomware operations.
Source: https://www.infosecurity-magazine.com/news/ransomware-surges-july-q2-lull/
A&M Communication cybersecurity rating report: https://www.rankiteo.com/company/anmadagency
"id": "ANM1786091023",
"linkid": "anmadagency",
"type": "Ransomware",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Healthcare',
'location': 'United States',
'name': 'AnMad',
'type': 'Healthcare Provider'},
{'industry': 'Government',
'location': 'Romania',
'name': 'Romania’s Land Registry Agency',
'type': 'Government Agency'}],
'data_breach': {'data_encryption': True, 'data_exfiltration': True},
'date_detected': '2026-07-01',
'date_publicly_disclosed': '2026-08-05',
'description': 'July 2026 marked a sharp rise in ransomware activity, '
'recording 799 claimed attacks. The 19% increase from June '
'targeted critical sectors, with finance (up 71%), technology '
'(62%), healthcare (46%), and education (44%) experiencing the '
'most significant spikes. U.S.-based organizations faced a 31% '
'increase in attacks compared to June. Notable incidents '
'included an attack on U.S. healthcare provider AnMad and a '
'strike on Romania’s land registry agency.',
'impact': {'brand_reputation_impact': True,
'data_compromised': True,
'downtime': True,
'operational_impact': 'Facility closures, database wipe, real '
'estate market disruption',
'systems_affected': True},
'lessons_learned': 'The attacks underscored evolving tactics, from system '
'takedowns to data theft and outright deletion, '
'reinforcing the need for robust backup strategies.',
'motivation': ['Financial gain', 'Data theft', 'Disruption'],
'ransomware': {'data_encryption': True, 'data_exfiltration': True},
'references': [{'date_accessed': '2026-08-05', 'source': 'Comparitech'}],
'threat_actor': ['The Gentlemen',
'Qilin',
'DragonForce',
'INC',
'CRPx0',
'SafePay'],
'title': 'Ransomware Attacks Surge in July 2026',
'type': 'Ransomware'}