Bridewell reports 80 percent ransomware surge as manufacturing Leads Q3 victims

A Bridewell threat intelligence tally put publicly disclosed ransomware victims at 2,889 for the third quarter of 2026, linking the postings to 111 active cartels across 121 countries.

That figure was up 80 percent from 1,609 victims counted during the third quarter of 2025. Bridewell said the quarterly average reached 963 victim postings per month. August posted the highest monthly total, reaching 1,064 against 970 in July and 855 in September.

Manufacturing led all industries with 474 victim postings in Q3 2026, a figure equal to 16.4 percent of every publicly disclosed victim. The sector’s Q2 2026 figures showed 274 postings and 12.4 percent of tracked cases. Technology counted 363 postings, Healthcare counted 285, and Professional Services represented 13.6 percent of activity.

Publicly listed victims in the United States reached 34.7 percent, the largest national share. Activity reached 121 countries across 13 different industry sectors during the quarter. Bridewell said leak-site postings show publicly disclosed victims only, since some organizations pay ransoms without appearing or are never listed publicly.

Activity concentrated heavily among leading operators, with the ten most active cartels accounting for 48 percent of all victim postings. Their combined share dropped from 56 percent in Q2 to 48 percent in Q3. Qilin, Thegentlemen and Incransom together made up 29 percent of postings, compared with 32 percent for the top three cartels in Q2.

Nearly half of the active cartels posted victim counts below 10, with 47 out of 111 falling under that threshold. Bridewell’s Q3 data ranked Qilin first with 362 claimed victims. Thegentlemen claimed 360 victims, while Incransom claimed 109.

Competing vendor data disagreed over the rankings. NordLayer counted 2,894 attacks from July through September 2026, an increase of almost 50 percent over 1,933 incidents in the same quarter of 2025. NordLayer placed The Gentlemen first with 383 attacks and Qilin second with 363, a gap of 20 attacks. Check Point counted 646 ransomware attacks in June 2026, up 33 percent from June 2025, and said The Gentlemen surpassed Qilin to lead during June 2026.

New operators emerged during the quarter. Storm surfaced in August with 41 victims listed that month, then reached 78 postings by quarter’s end. Direwolf emerged in August, starting with 43 victims and closing the quarter at 60 postings. SafePay counted 73 victims across the quarter, moving from 12 postings in August to 32 in September, a 167 percent increase.

Other operators posted sharp month-on-month growth. Clop postings jumped 4,400 percent, starting from one victim in July and reaching 45 in August. SilentRansomGroup saw postings rise 467 percent, from three victims to 17. Everest doubled its monthly postings, moving from six in August to 12 in September.

Black Kite counted 1,183 manufacturing victims from January through July 2026, an increase of 39.7 percent over the same months in 2025. The firm said manufacturing held the top target spot for five straight years, counting 1,660 victims and a 22.0 percent share of all disclosures between April 2025 and March 2026. Qilin led manufacturing with 178 victims from January through July 2026, while The Gentlemen ranked second with 142.

The Gentlemen surfaced in September 2025 and claimed 142 manufacturing victims from January through July 2026. The US manufacturing victim share dropped from 52.3 percent during January-to-July 2025 to 34.8 percent in the same months of 2026.

In 2025, exploited vulnerabilities were behind 32 percent of ransomware incidents that hit manufacturing and production organizations. Manufacturers saw extortion-only incidents climb from 3 percent in 2024 to 10 percent in 2025. Encryption played a smaller role, with attacks dropping from 74 percent to 40 percent.

Among manufacturers with encrypted data, 51 percent of cases involved a ransom payment. Average recovery costs, not including ransom, came to $1.3 million. NordLayer counted 805 recorded attacks against the US in Q3 2026, making it the top target. Healthcare saw the biggest sector jump in Q3 2026, with attacks up 30 percent to 150 from 115 in Q2.

GuidePoint counted 7,515 publicly posted ransomware victims for 2025, a 58 percent rise over the prior year. GuidePoint tracked 112 active ransomware cartels in Q3 2026. INC Ransom reached third place with 110 attacks during Q3 2026.

“Ransomware DLS activity rebounded sharply in Q3 2026, with 2,889 victim postings recorded – approximately 30% higher than Q2,” Bridewell said. The firm expressed moderate confidence that high activity would persist through the fourth quarter of 2026.

NordLayer’s intelligence arm offered its own read on the market. “Ransomware is more competitive, active, and varied than it was a year ago, and the groups behind it are fighting to prove themselves,” said Vakaris Noreika, cybersecurity expert at NordLayer Intelligence by NordStellar.