Ransomware Attacks Surge 53% YoY as KillSec Arrest Made | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

Ransomware attacks have hit their highest recorded pace of 2026, and the numbers released this week give the clearest picture yet of how bad the problem has become. Check Point Research logged a 48% year-over-year jump in global cyberattacks for September 2026, with reported ransomware attacks specifically up 53% over the same month last year. Organizations absorbed an average of 2,803 attacks per week globally during that stretch, and education topped the list of targeted sectors. The spike lands the same week international police confirmed the arrest of a suspect tied to the KillSec ransomware group, alongside fresh victim disclosures from Japan, Ukraine, and the United States.The KillSec Arrest: Inside the Takedown of a Global Extortion RingRansomware Attacks 2026: What the Numbers Actually ShowRansomware Statistics by Source: October 2026 SnapshotSemperis Survey: Intimidation Tactics Are EscalatingCase Study: Osaka Metropolitan University’s 500-Server ShutdownIDC Frontier’s Cloud Outage Shows the Infrastructure RiskBYOD and the Trump Mobile Data Leak ClaimATB Ukraine: DataSuckers Claims 7.9 Million Exposed RecordsThe Supply-Chain Pattern Behind October’s Breach WaveOctober 2026 Ransomware and Breach Incident TrackerMarket Impact: Cyber Insurance, Budgets, and Vendor StocksHistorical Context: How Ransomware Got HereCompetitive Landscape: How Security Vendors Are RespondingHow to Prevent Ransomware Attacks: What Changed in 2026Predictions: Where Ransomware Attacks Go NextWhat This Means for IT Buyers Right NowFrequently Asked QuestionsRelated Coverage

For a security industry that spent most of 2025 insisting ransomware had plateaued, October 2026 is a correction. Fortinet’s 2026 Global Threat Landscape Report counted 7,831 confirmed ransomware victims globally this year, compared with roughly 1,600 in last year’s report, a jump the vendor describes as a 389% year-over-year increase. Bitdefender’s October threat debrief adds another data point: 790 claimed ransomware victims in September 2026 alone, a 30% rise over September 2025. Different vendors, different methodologies, same direction. The question for CISOs, insurers, and IT buyers isn’t whether ransomware attacks are accelerating anymore. It’s what to do about it before their organization becomes the next line item in next month’s report.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.

One email a week. No spam, unsubscribe anytime.

Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

The KillSec Arrest: Inside the Takedown of a Global Extortion Ring

Spanish police arrested a 16-year-old suspected of operating the KillSec ransomware group, seizing the group’s leak site and servers in a coordinated action that also netted two other suspects on September 30, 2026. KillSec’s playbook followed the now-standard double-extortion model: steal an organization’s data, then threaten to publish it on a dark-web leak site unless the victim pays. What set KillSec apart, according to investigators, was the breadth of its targeting.

Dmitry Volkov, CEO of threat intelligence firm Group-IB, described the group’s reach bluntly: “KillSec’s affiliates went after the organizations people depend on most: hospitals, government bodies, and financial institutions.” That framing matters because it underscores a shift in ransomware economics. Groups no longer need to hit a single Fortune 500 target for a seven-figure payout; a ransomware-as-a-service affiliate model lets low-skill operators, in this case allegedly including a teenager, rent access to extortion infrastructure and go after softer, higher-volume targets like regional hospitals and municipal agencies that can least afford downtime.

The arrest is a genuine law enforcement win, but security researchers caution against reading it as a dent in the broader ransomware economy. Leak sites get seized and affiliate programs get disrupted with some regularity; the underlying supply chain of initial-access brokers, bulletproof hosting, and cryptocurrency laundering infrastructure that keeps these groups funded has proven far more durable than any single leak site.

Ransomware Attacks 2026: What the Numbers Actually Show

The headline figure, Check Point’s 53% year-over-year increase in reported ransomware attacks, needs context to be useful. Check Point’s September 2026 threat intelligence report also found that organizations faced an average of 2,803 cyberattacks per week globally during the month, up 48% from the same period a year earlier. Education was the single most targeted sector, a pattern that has held for several consecutive reporting cycles as schools and universities continue to run under-resourced IT departments against increasingly automated attack tooling.

Fortinet’s separately published 2026 Global Threat Landscape Report arrives at an even steeper trajectory: 7,831 confirmed ransomware victims tracked globally this year against roughly 1,600 in its 2025 report, a 389% year-over-year increase in the vendor’s own telemetry. Fortinet ties part of that growth to what it calls AI-enabled cybercrime, meaning attackers are using generative tools to speed up reconnaissance, phishing lure creation, and even malware obfuscation, lowering the skill floor needed to run a profitable ransomware operation.

Bitdefender’s October 2026 threat debrief narrows the lens to a single month: 790 claimed ransomware victims in September 2026, a 30% increase compared with September 2025. The gap between Fortinet’s 389% figure and Bitdefender’s 30% figure isn’t a contradiction; it reflects different counting methods. Fortinet appears to be counting cumulative confirmed victims across a longer tracking window, while Bitdefender is isolating a single calendar month of claimed leak-site postings. Readers comparing ransomware statistics across vendors should always check whether a report is counting confirmed incidents, claimed leak-site victims, or raw attack attempts, because those are three very different denominators.

Ransomware Statistics by Source: October 2026 Snapshot

Research SourceMetricFigureReporting Period

Check Point ResearchYear-over-year increase in global cyberattacks48%September 2026
Check Point ResearchYear-over-year increase in ransomware attacks53%September 2026
Check Point ResearchAverage weekly attacks per organization2,803September 2026
FortinetConfirmed global ransomware victims (2026 vs. ~1,600 in 2025)7,831 (+389% YoY)Full year 2026 report
BitdefenderClaimed ransomware victims, single month790 (+30% YoY)September 2026
SemperisAttacks involving psychological intimidation of victims~25%2026 Ransomware Risk Report
SemperisCases where attackers followed through on threats53%2026 Ransomware Risk Report

Semperis Survey: Intimidation Tactics Are Escalating

Beyond raw attack volume, the 2026 Semperis Ransomware Risk Report captures a darker trend in how extortion groups pressure victims. Semperis found that psychological intimidation occurred in nearly 25% of ransomware attacks across the countries covered by its survey, a category that includes threats against named executives, their families, or public reputational damage campaigns separate from the data-leak threat itself. The same report found that hackers followed through on their threats in 53% of ransomware cases reported by victims, meaning roughly half the time an organization that refuses to pay, or pays but still gets burned, actually sees the attacker make good on the follow-up threat.

That 53% follow-through rate is the uncomfortable number for incident response teams. It undercuts the common advice that paying a ransom guarantees data deletion or silence, since Semperis’s own data shows attackers carry out threats in roughly half of cases regardless of what the victim does. It also explains why insurers and federal agencies, including the FBI, continue to discourage ransom payments even when the short-term pressure to pay is enormous.

Case Study: Osaka Metropolitan University’s 500-Server Shutdown

Osaka Metropolitan University suffered a suspected ransomware attack that disrupted classes, internal networks, email, and administrative systems, with approximately 500 servers affected by the incident. Personal information belonging to at least 130,000 individuals may have been exposed. The scale of the outage, hundreds of servers down simultaneously at a major public university, illustrates why education remains Check Point’s most-targeted sector: universities run large, decentralized IT environments with thousands of endpoints, inconsistent patching across departments, and valuable personal data on students, staff, and alumni, all without the security budgets of a comparable-sized enterprise.

IDC Frontier’s Cloud Outage Shows the Infrastructure Risk

IDC Frontier, a Japanese cloud infrastructure provider, disclosed a ransomware attack against its cloud service that caused an outage at a data-center cluster serving eastern Japan. When a ransomware attack hits a cloud or managed-service provider rather than a single enterprise, the blast radius multiplies instantly, every downstream customer relying on that infrastructure inherits the outage. It’s the same supply-chain dynamic that played out when a compromised ConnectWise Cloud Backup application credential was used to sign into 173 Microsoft 365 tenants, an incident detailed by The Hacker News and corroborated by independent analysis from the Cloud Security Alliance. One vendor’s compromised credential, 173 organizations exposed. The IDC Frontier incident is the same math applied to raw compute infrastructure instead of a backup tool.

BYOD and the Trump Mobile Data Leak Claim

A ransomware group calling itself BYOD claimed that personal data belonging to Trump Mobile customers appeared on a dark-web leak site. As with most leak-site claims, the scope and authenticity of the data have not been independently verified at the time of writing, and the exact number of affected customers is unconfirmed. What is notable is the target selection: ransomware groups increasingly go after politically or commercially high-profile brands specifically because the leak gets amplified by media coverage, adding reputational pressure on top of the standard extortion demand. Security teams evaluating this kind of claim should treat it as unconfirmed until the named organization or an independent forensic firm verifies the data set, rather than assuming a leak-site post is automatically legitimate.

ATB Ukraine: DataSuckers Claims 7.9 Million Exposed Records

ATB, Ukraine’s largest grocery retailer, experienced a cyberattack that disrupted its online services and included an extortion demand. A group calling itself DataSuckers claimed it stole records involving 7.9 million ATB customers, including names, addresses, passport information, and order records. If the claimed figures hold up under verification, it would rank among the largest consumer-data exposure claims tied to a single ransomware-style extortion incident so far in 2026. Retailers in active conflict zones face a compounding risk: wartime strain on IT staffing and infrastructure resilience makes them more attractive targets precisely when they have the fewest resources to defend against or recover from an attack.

The Supply-Chain Pattern Behind October’s Breach Wave

Zoom out across this month’s disclosures and a pattern emerges: attackers are increasingly going after the vendor, platform, or backup provider that sits upstream of many organizations at once, rather than breaching each target directly. The ConnectWise Cloud Backup incident, where BleepingComputer confirmed hackers accessed 173 Microsoft 365 tenants through a single compromised application credential, is the clearest example this month, and it followed closely on the heels of Brooklyn District Attorney investigators, detailed in a Bloomberg feature, unwinding a scam network that spanned three time zones using stolen financial credentials. Separately, a SpecterOps analysis walked defenders through how to check their own Microsoft 365 tenant for signs of the same compromised-credential pattern.

Our earlier coverage of the ConnectWise breach and its frozen backups and the related Brooklyn prosecutor’s takedown of a cross-border scam ring both point to the same underlying weakness: identity and credential management at the vendor layer, not just at the end-customer layer, is now the primary attack surface. A separate international campaign involving an initial-access broker supplying stolen credentials and footholds to multiple ransomware groups simultaneously, reported by Cybersecurity Dive, reinforces that this isn’t a single-vendor problem. It’s a market structure where access brokers specialize in breaking in, and ransomware affiliates specialize in monetizing that access once it’s sold.

October 2026 Ransomware and Breach Incident Tracker

IncidentAttacker / GroupScaleStatus

KillSec leak site and server seizureKillSec (suspect, age 16, plus two others arrested)Multiple hospital, government, financial targetsSuspects arrested Sept. 30, 2026
Osaka Metropolitan UniversityUnconfirmed, suspected ransomware~500 servers affected, 130,000+ individualsUnder investigation
IDC Frontier cloud outageUnconfirmed ransomware actorData-center cluster, eastern JapanService disruption confirmed
Trump Mobile customer data claimBYODUnconfirmed scopeClaim unverified
ATB Ukraine retailer breachDataSuckers7.9 million customer records claimedClaim unverified, extortion demand issued
ConnectWise Cloud Backup credential compromiseUnconfirmed threat actor173 Microsoft 365 tenantsAccess shut down by ConnectWise, under investigation

Market Impact: Cyber Insurance, Budgets, and Vendor Stocks

A 53% year-over-year jump in reported ransomware attacks has direct, measurable effects beyond the IT department. Cyber insurance underwriters price premiums off exactly this kind of frequency and severity data, and a sustained increase in confirmed victims, as Fortinet’s 389% figure suggests, tends to flow through to higher premiums and stricter policy requirements, like mandatory endpoint detection and response coverage or multi-factor authentication, within one to two renewal cycles. Enterprises that fail baseline security questionnaires increasingly find themselves uninsurable for ransomware-specific coverage altogether, pushing the cost of a weak security posture from a hypothetical breach cost into a guaranteed line-item expense today.

On the vendor side, security budgets are shifting toward identity and access management, backup immutability, and managed detection and response services, the three categories most directly implicated in this month’s incidents. Our comparison of EDR, XDR, and MDR market positioning found a widening price and capability gap between vendors as enterprise buyers consolidate detection spend into fewer, broader platforms rather than point products, a trend this month’s attack volume is likely to accelerate rather than reverse.

Historical Context: How Ransomware Got Here

Ransomware’s evolution over the past six years tracks a steady professionalization curve. The 2020 to 2022 period was defined by big-name, single-target hits against critical infrastructure operators. By 2023 and 2024, ransomware-as-a-service platforms matured, letting lower-skill affiliates rent access to encryption tooling and leak-site infrastructure in exchange for a cut of ransom payments, which is exactly the affiliate structure investigators say KillSec used. The 2025-to-2026 shift, according to Fortinet’s framing of AI-enabled cybercrime, adds a new layer: generative tools now help attackers write more convincing phishing lures, automate reconnaissance of target networks, and even assist with obfuscating malware to dodge signature-based detection. Each stage lowered the barrier to entry further, which is a large part of why a 16-year-old suspect could allegedly run operations significant enough to draw an international law enforcement response.

That trajectory also explains why year-over-year comparisons across different vendor reports can look wildly inconsistent. Fortinet’s 389% jump, Bitdefender’s 30% jump, and Check Point’s 53% jump are all measuring real growth, just across different slices of time, geography, and incident-counting methodology. The consistent signal across all three is direction, not magnitude: ransomware attacks are getting more frequent, not less, heading into 2027.

Competitive Landscape: How Security Vendors Are Responding

The vendor response to this surge splits along a few lines. Identity-focused vendors like Semperis are pushing enterprises to harden Active Directory and identity infrastructure specifically, since so much of this month’s incident wave traces back to compromised credentials rather than novel malware. Detection vendors are leaning on the EDR-to-XDR-to-MDR consolidation trend, betting that enterprises will pay for broader, correlated visibility across endpoints, cloud, identity, and network rather than managing a patchwork of specialized tools. Backup and recovery vendors face the trickiest position: the ConnectWise incident is a reminder that the backup layer itself is now a prime target, since compromising a backup provider’s credentials can give an attacker access to every downstream customer relying on that provider, which is precisely the opposite of what backup infrastructure is supposed to protect against.

Meanwhile, threat intelligence and data governance vendors, the Check Points, Fortinets, Bitdefenders, and Semperises of the world, are increasingly differentiating on reporting cadence and methodology transparency rather than raw feature lists. In a market where every vendor publishes a different ransomware statistic, the ones that clearly disclose their counting methodology, confirmed victims versus claimed leak-site postings versus raw attack attempts, are becoming more trusted by enterprise security buyers who need comparable numbers to justify budget requests.

How to Prevent Ransomware Attacks: What Changed in 2026

The baseline advice, offline backups, patching, multi-factor authentication, and user training, hasn’t changed. What has changed is where defenders need to focus first. Given the pattern across this month’s incidents, three priorities stand out. First, audit third-party application credentials with the same scrutiny as employee accounts; the ConnectWise incident happened because a single application-level credential, not a human user account, had broad access across hundreds of customer tenants. Second, treat backup infrastructure as a primary target rather than a recovery afterthought, since attackers increasingly go after the backup layer specifically to deny victims a clean restore path before deploying encryption. Third, assume leak-site claims from unfamiliar group names like BYOD or DataSuckers require independent verification before triggering a public response, since unverified claims can cause as much reputational damage as a confirmed breach if handled poorly.

Organizations in education, the sector Check Point flagged as most targeted, face a harder version of this problem: large, decentralized networks with thousands of devices and comparatively thin security budgets. For those environments, network-level detection tools that don’t require per-endpoint agent rollout, the kind of approach covered in our guide to setting up Suricata for network intrusion detection, offer a more realistic starting point than enterprise EDR suites that assume full device management control.

Predictions: Where Ransomware Attacks Go Next

Expect more vendor-layer compromises like the ConnectWise incident through early 2027, as attackers realize one compromised supply-chain credential scales better than breaching targets individually.
Cyber insurance underwriting will keep tightening, with more carriers requiring proof of immutable backups and privileged-access management before issuing ransomware-specific coverage.
Education and healthcare will remain the two most-targeted sectors through at least mid-2027, given the gap between their data sensitivity and their security budgets.
AI-assisted phishing and reconnaissance, the trend Fortinet highlights in its 2026 report, will keep widening the pool of capable attackers, including minors, as the KillSec case already demonstrates.
Expect at least one more major cloud or backup provider disclosure before year-end 2026, following the IDC Frontier and ConnectWise pattern of attackers targeting infrastructure that serves many downstream customers at once.

What This Means for IT Buyers Right Now

For security leaders reading these numbers today, the practical takeaway isn’t panic, it’s prioritization. A 53% year-over-year rise in reported ransomware attacks, confirmed by Check Point’s September 2026 data, combined with Fortinet’s 389% jump in confirmed victims, means budget conversations about backup immutability, third-party credential audits, and identity hardening are no longer theoretical. Semperis’s finding that attackers follow through on threats in 53% of cases, regardless of whether a victim pays, should also reframe incident response planning: the goal isn’t negotiating a better outcome with the attacker, it’s preventing the initial compromise and having a clean, verified restore path that doesn’t depend on the attacker’s goodwill at all.

Frequently Asked Questions

What caused the 53% rise in ransomware attacks reported in October 2026?Check Point Research’s September 2026 threat intelligence report attributes the year-over-year increase to a broader 48% rise in global cyberattack volume, with ransomware-as-a-service affiliate models and, according to Fortinet, increasing use of AI tools for phishing and reconnaissance lowering the barrier for attackers to launch campaigns.

Who was arrested in the KillSec ransomware case?Spanish police arrested a 16-year-old suspected of operating the KillSec ransomware group along with two other suspects on September 30, 2026, seizing the group’s leak site and servers in the process.

Which sector is most targeted by ransomware right now?Check Point Research identified education as the most targeted sector in its September 2026 data, a pattern consistent with earlier 2026 reporting cycles due to large, decentralized networks and comparatively limited security budgets at many schools and universities.

Does paying a ransom guarantee attackers won’t leak stolen data?No. Semperis’s 2026 Ransomware Risk Report found that attackers followed through on their extortion threats in 53% of reported cases, a figure that does not guarantee any correlation with payment, underscoring why law enforcement agencies generally discourage ransom payments.

What happened in the ConnectWise Cloud Backup incident?A compromised application credential tied to ConnectWise’s Cloud Backup service was used to sign into 173 Microsoft 365 tenants, according to reporting from The Hacker News and BleepingComputer. ConnectWise shut down Cloud Backup application access while investigating and stated it had no indicators that partner backup data itself had been compromised.

How reliable are ransomware victim-count claims from leak sites?Claims posted by groups like BYOD or DataSuckers on dark-web leak sites are not independently verified at the time of posting. Security teams and reporters should treat specific victim counts and data-type claims as unconfirmed until the named organization or an independent forensic investigation corroborates them.

What is the single most effective step an organization can take against ransomware in 2026?Based on this month’s incident pattern, auditing and limiting the scope of third-party application credentials, not just human user accounts, combined with maintaining immutable, independently tested backups, addresses the two failure points most visible in October 2026’s disclosures.

Are ransomware statistics from different security vendors comparable?Not directly. Fortinet, Bitdefender, and Check Point each use different counting methods, confirmed victims, claimed leak-site postings, and raw attack attempts respectively, so year-over-year percentage changes should be compared within a single vendor’s methodology rather than across vendors.

Related Coverage
Elias VirtanenCybersecurity AnalystElias Virtanen is the Cybersecurity Analyst at Tech Insider, bringing hands-on expertise from his background in penetration testing and security consulting. He previously worked as a security researcher at F-Secure in Helsinki, where he focused on threat intelligence and vulnerability disclosure. Elias covers ransomware trends, zero-trust architecture, and the evolving regulatory landscape including NIS2 and the EU Cyber Resilience Act. He holds a CISSP certification and an MSc in Information Security from Aalto University.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.

One email a week. No spam, unsubscribe anytime.

——————————————————–
Click Here For The Original Source.

…………………….

Related