Ransomware Victim Claims Reached Year-to-Date High in July 2026, NCC Group Reports

Ransomware Activity Surges in July 2026

NCC Group's July threat advisory report indicates a significant increase in ransomware activity, with 894 victim organization listings recorded in July 2026. This marks a year-to-date high and represents a 22% increase in global ransomware attacks compared to June 2026. The report also noted the first recorded incident of a fully agentic AI ransomware attack chain during this period.

Contributing Factors and Targeted Sectors

The surge in ransomware activity is attributed to the emergence of new ransomware groups, including "The Gentleman," and the use of agentic AI in attack chains. Industrial, consumer services, and technology sectors were the most frequently targeted, alongside critical services, finance, and healthcare. Geographically, 41% of recorded incidents occurred in the US, 29% in Europe, 14% in Asia, and 9% in South America.

Notable Incidents and Cybercriminal Claims

Several high-profile organizations were affected in July, including Ernst & Young (EY), which experienced a data breach claimed by ShinyHunters, and Coca-Cola's Fairlife, which suffered an attack attributed to Anubis. While some incidents involved verified data theft, the report suggests that some new cybercriminal groups, such as CRPxO, may inflate victim claims to establish their reputation. CRPxO, operating a Ransomware-as-a-Service (RaaS) model, claimed 36 hacks shortly after its emergence.