Inteligência de ameaças
Ransomware Reaches Record High in Q3, Financial Sector Attacks Increase by 72%
Two independent reports show the highest ransomware quarter on record. Comparitech counted 2,627 alleged attacks and 199 in finance, a 72% increase. GuidePoint recorded 2,760 victims and 112 active groups. Brazil is not included in the data.
The third quarter of 2026 saw the highest number of ransomware attacks ever recorded, according to two reports published in the first week of October. Comparitech counted 2,627 alleged attacks by criminal groups, approximately 29 per day. GuidePoint Security recorded 2,760 victims, 21% more than in the second quarter and 75% more than in the third quarter of 2025. In both reports, the financial sector is highlighted.
What the Reports Show
| Item | Comparitech | GuidePoint (GRIT) |
|---|---|---|
| Quarterly Volume | 2,627 alleged attacks (2,030 in Q2; 1,636 in Q3 2025) | 2,760 victims (+21% over Q2; +75% over Q3 2025) |
| Confirmed by Victims | 247 (approx. 9%) | not reported |
| Most Active Groups | Qilin (357 allegations) and The Gentlemen (342) | The Gentlemen (12.9% of victims) and Qilin (12.6%) |
| Active Groups | not reported | 112 (+23% in the quarter; +47% year-on-year) |
| Financial Sector | 199 attacks, compared to 116 in the previous quarter (+72%) | banks and financial services returned to the top 10 |
| Geographical Reach | USA with 41% of attacks; Argentina with 45 (+150%) | 115 countries; USA with 42% of victims |
Comparitech also reports a median ransom demand of US$150,000 and an average of US$602,400, and the return of Clop, which went from 1 attack in the previous quarter to 48. GuidePoint attributes part of the financial sector's return to the top 10 to a social engineering campaign against private equity firms, and highlights the advancement of ShinyHunters in data extortion.
An important detail from GuidePoint: the ransom payment rate dropped by more than half in one year, but the average amount paid by those who paid increased by 34%. Fewer people are paying, and those who do pay, pay more. The company also states that the increasing use of AI agents in crime shortens the time between initial access and impact.
How to Interpret These Numbers
An "alleged" attack is not a confirmed attack. Comparitech counts what groups claim to have done on their leak sites, and only 247 out of 2,627 were acknowledged by the victims themselves. GuidePoint counts victims published on these sites. These are different methods, which is why the totals do not match; what matters is that both point in the same direction: a record. Comparitech itself reminds us that allegations usually appear weeks or months after the attacks, so the numbers tend to change.
Another caution: neither report discloses data from Brazil. It is not possible to state, based on these reports, that attacks have increased in the country. What is known is the global trend and that of the financial sector.
Why This Matters for Financial Institutions
There are two messages. The first is that the financial sector saw a 72% increase in one quarter in Comparitech's count, from 116 to 199 attacks, and returned to GuidePoint's top 10. The second is the attack method: social engineering against private equity shows that the target is not always the bank, but rather those who have access to a large amount of data at once. For an institution, this also applies to suppliers who store or process its data.
With fewer victims paying, extortion is migrating to data leaks, which makes business continuity and incident management as important as backup.
What to Do Now
- Test the restoration of critical system backups, with measured time, and confirm that at least one copy remains out of reach of those who control the domain.
- Review what is exposed to the internet (VPN, remote access, application servers) and the correction deadline. This is the most common entry point in this year's reports.
- Include in third-party risk analysis suppliers and managers who concentrate institutional data, such as the private equity firms cited by GuidePoint, and request evidence of controls.
- Conduct a ransomware tabletop exercise with decisions on payment, communication to clients and regulators, and data breaches, with recorded dates and participants.
- Train customer service and IT departments for access requests by phone or message, which is the path of social engineering described in the report.
References
- Ransomware roundup Q3 2026: stats on attacks, ransoms and active gangs: Comparitech, October 7, 2026
- Q3 2026 Sets New Record for Ransomware Attacks: Infosecurity Magazine, October 9, 2026
- GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: GuidePoint Security, October 2026
- GuidePoint Security Reports Record-High Ransomware Activity as Victims Rise 75% Year Over Year: Business Wire, October 8, 2026