The IT Nerd

his morning, Comparitech researchers published a study looking at ransomware attacks in October 2026, finding that the number of attacks surpassed the 1K mark for the second time this year, with an average of 33 attacks per day. The research takes a look at ransomware attacks by sector, which ransomware gangs were most prolific, which countries were most targeted, and more.

Commenting on the findings is Rebecca Moody, Head of Data Research at Comparitech:

“Despite a slight reprieve in ransomware attacks in September, levels surpassed 1,000 for the second time this year in October. The sheer scale of attacks is hugely concerning, particularly as key sectors like education and healthcare are seeing record-breaking levels.

As AI continues to aid hackers’ speed and ability to find and exploit vulnerabilities, now’s the time to take heed and make sure those essential basics are being covered. Last month’s attack on GMO Internet, Inc. should serve as a stark warning to every organization. The tech company is currently dealing with the fallout of a massive attack that has impacted multiple companies and as many as 26,739 servers. It not only highlights the risk of inadequate cybersecurity practices but also hackers’ growing ambition to target individual companies/customers affected by an attack on a central organization.

GMO has just admitted that it hadn’t adequately dealt with a vulnerability that was flagged two years ago and that hackers were able to access customers’ virtual private servers (VPSs) and GMO’s “drive-sharing” feature to download files stored on customers’ computers. These customers are now being blackmailed with hackers threatening to send browsing histories and confidential data to individual victims’ family members and customer contacts.

At a time when it’s a case of when not if you’re going to have to deal with some kind of cybersecurity incident, be it within your own systems or those of a third-party service, it’s vital basics are being covered. That data backup, patched vulnerability, employee training, or system update could be the difference between thwarting an attack before it’s even started or finding yourself up the proverbial creek without a paddle.”

The full research can be read here: https://www.comparitech.com/news/ransomware-roundup-october-2026/

Comparitech researchers have published a study looking at government ransomware attacks in Q3 2026, finding that there was a 47% in attacks since Q2 and a 91% increase from the same period last year. The study breaks down some of the biggest government ransomware attacks in the quarter, which countries were most targeted, which ransomware gangs were most prolific, the average ransom demand, and more.

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment on the findings:

“It goes without saying that governments remain a focus for hackers because of the sheer amount of disruption these attacks can cause, both through system encryption and data theft. But what our Q3 report demonstrates is that, as ransomware attacks continue to increase in volume, it has never been more important for government entities to do what they can to mitigate these risks and have a worst-case-scenario plan in place. No government entity, large or small, previously targeted or not, is immune.

As part of their worst-case-scenario plan, government entities not only need to have a clear strategy in place for how they will deal with an attack (e.g. making sure there are regular backups in place to get systems back online as soon as possible), but they also need to assume that a data breach has occurred. Hackers will have stolen data in the majority of cases, so issuing warnings to anyone involved promptly is essential to safeguarding this data. Better to warn people straight away and retract this warning later on if data hasn’t been stolen, than to avoid warning people until months after the attack when there’s little they can do if their data has been floating around on the dark web for all that time.”

More info here: https://www.comparitech.com/news/government-ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-data-breaches/

Comparitech researchers have publised a new study looking at which of the world’s wealthiest countries are the least prepared for cyber attacks. To find this out, Comparitech measured the national cybersecurity capability and institutional preparedness of the world’s 50 biggest economies.

According to the findings, the size of an economy doesn’t necessarily equate to a country’s ability to deal with cyber attacks. In fact, GDP barely correlates with overall scores.

Key findings include:

• The top five most-prepared countries were Finland (96.2), Australia (95.2), the Netherlands and Austria (94.7 each), and France (94.6).
• The five least-prepared countries were Iran (44.2), Mexico (48.5), Pakistan (50.2), Argentina (60.3), and Egypt (61.3).
• 14 of the 50 countries lacked standalone national cybersecurity legislation and a further eight only had partial legislation.
• 5 of the 50 countries lacked mandatory incident reporting for attacks on critical infrastructure.
• 18 of the 50 countries have not signed, ratified, or acceded to the Budapest Convention on Cybercrime.

More details here: https://www.comparitech.com/news/cybersecurity-rankings-by-country-which-of-the-worlds-biggest-economies-are-the-least-prepared-for-cyber-attacks

This morning, Comparitech researchers published a study looking at education ransomware in Q3 2026. According to the findings, ransomware attacks on the education sector increased by 54% from the previous quarter.

Other key findings include:

• 77 attacks in total
• 25 confirmed attacks
• 52 unconfirmed attacks
• 13,000 records are known to have been breached in the confirmed attacks
• Median ransom demand: $510,000 – down slightly from $583,000 in Q2 2026
• The ransomware strains that made the most attack claims were Qilin (12) and The Gentlemen (9), followed by INC, Panzer, and KRYBIT (4 each)
• Qilin claimed the most confirmed attacks (5), followed by INC (3), The Gentlemen, Interlock, and NightSpire (2 each)
• The US saw the most attacks with 31 in total – a 182 percent increase from Q2 2026

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment:

“While we noted a 29% surge in ransomware attacks across all sectors from Q2 to Q3 this year, attacks on the education sector were far higher at 54%. What’s also clear from the details we have about the confirmed attacks in Q3 is that ransomware remains incredibly disruptive and costly for educational institutions. Many attacks witnessed not only resulted in extensive downtime and/or school closures but also large data breaches.

As hackers continue to focus on maximizing their impact through system encryption and data theft, the education sector remains an attractive target because of how impactful both of these extortion tactics are. We’re not just talking about hackers taking down the internet and accessing student/staff data, but also having the ability to take control of key systems, such as school cameras, locks, and HVAC systems. This was something of huge concern in an attack confirmed over the weekend at Jerome School District in the US. Classes were canceled yesterday as a result.

It’s crucial schools, colleges, and universities continue to cover the basics — patching vulnerabilities, updating software, carrying out regular backups and employee training, and having clear plans in place if systems are infected. The figures we’re seeing this quarter (and the high volume we’re seeing in October already) demonstrate that ransomware remains a primary threat to the education sector.”

The full study can be read here: https://www.comparitech.com/news/education-ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-data-breaches/

Comparitech researchers have published a study looking at healthcare ransomware in Q3 2026. According to the findings, ransomware attacks on the healthcare sector reached a new high with an average of 3.33 attacks per day. Attacks rose by 40 percent when compared to Q2 2026, and more than doubled when compared to the same period last year. 

Key findings include: 

Healthcare providers

• 192 attacks in total
• 40 confirmed attacks
• 152 unconfirmed attacks
• 618,149 records are known to have been breached in the confirmed attacks
• Median ransom demand: $300,000

The most prolific ransomware strains with the highest number of claims against healthcare providers were The Gentlemen (18), INC (14), KRYBIT and Storm (11 each), and Qilin and Dire Wolf (10 each)

Chaos had the most confirmed attacks (5), followed by INC and The Gentlemen (3 each)

Healthcare businesses

• 114 attacks in total
• 13 confirmed attacks
• 101 unconfirmed attacks

No records are known to have been breached in the confirmed attacks

Median ransom demand of $150,000

The most prolific ransomware strains with the highest number of claims against healthcare companies were Qilin (15) and The Gentlemen (13)

Chaos had the most confirmed attacks (3), followed by The Gentlemen (2)

Rebecca Moody, Head of Data Research at Comparitech had this to say: 

“The increases we’ve noted in the healthcare sector are well above average because, unfortunately, it remains one of the most lucrative targets for hackers. Encrypting systems within this sector can have a catastrophic effect, while the datasets often stored by these organizations are a treasure trove of highly sensitive information. 

The sector doesn’t appear to be a go-to target for every group, however. Qilin, which has dominated attacks over the last year or so, doesn’t come out on top in our findings. Rather, The Gentlemen is one of the sector’s biggest threats and it’s sharp uptick in attacks since the start of this year has likely added to the increase we’re seeing. 

Making sure the basics (frequent backups, patching vulnerabilities, keeping systems up to date, and carrying out cybersecurity training for all employees) remain at the heart of mitigating the risks of these attacks. Equally, when providing updates on attacks as they’re happening, organizations should assume the worst. A number of cases last quarter saw healthcare entities saying that there was no evidence of a breach before backtracking and issuing notifications/warnings to people who may have been affected later. While breaches may not be evident at the start, most hacking groups will have stolen data before encrypting systems.”

You can read more here: https://www.comparitech.com/news/healthcare-ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-data-breaches/

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world’s largest payment networks, and is threatening to release the stolen data. MoneyGram serves 60 million active customers across more than 200 countries. 

Rebecca Moody, Head of Data Research at Comparitech: 

“The Gentlemen has become one of the most prolific ransomware groups of recent years and isn’t known for fabricating its claims. MoneyGram needs to issue a statement as soon as possible to either reassure its customers that a breach hasn’t occurred or warn them of any potential unauthorized access to its systems.

Financial organizations are a key target for ransomware groups because of the highly sensitive data they deal with. The Gentlemen has claimed 46 attacks on such entities so far this year. 

Also of note is its attack on a South African tech company, MIP Holdings. This took place in June 2026, with MIP paying The Gentlemen a ransom to delete the stolen data. However, The Gentlemen has now started targeting MIP’s clients and is issuing them with their own ransom demand. This serves as a key reminder that paying a ransomware group to delete data doesn’t guarantee any data will be deleted. In MoneyGram’s case, regardless of whether or not negotiations are successful, individual customers could be contacted by the group. Therefore, MoneyGram’s customers and employees should be on high alert for any potential phishing messages and unauthorized account activity.”

Brian Higgins, Security Specialist at Comparitech:

“It’s very early in the incident response timeline but that’s no reason for anyone who may be affected should this attack prove genuine not to be extra vigilant whilst more details become available. It’s not MoneyGram’s first rodeo so there’s a good chance they will be able to offer decent information and advice as things progress, so it would be a good idea to monitor their comms output. Unfortunately these days more and more people are aware of the personal mitigations they should be considering; changing passwords, monitoring accounts, ignoring and reporting unsolicited contact and checking they have two-factor authentication applied wherever possible etc, but given the volume and diversity of the potentially vulnerable client base on this occasion it’s worth checking in with family, friends and others in your community to make sure they are doing the same. Nobody wants to be worried about their personal financial info being compromised going into Thanksgiving and Christmas so it can only help to look after each other where you can.”

Comparitech in August published a study of The Gentleman ransomware, which can be read here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Clients of Goldman Sachs’ wealth management division and UK-listed hedge fund Man Group are among the victims (paywall) of a major data breach at Big Four accounting firm EY, according to notifications sent out in recent weeks.

In other words, this is bad.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“This breach underlines how modern businesses rely on multiple layers of third-party software over which they have minimal oversight. Goldman Sachs didn’t get hacked. A vendor to a vendor to Goldman Sachs got hacked. Goldman Sachs entrusts client data to both of those vendors but has little to no oversight of either’s security. But clients entrusted Goldman Sachs with their data, not the vendors. Businesses are responsible for the security failures of vendors that they entrust with private data.”

Third party hacks are a thing. So if you assume that you’re only secure as the people you work with, you need to audit those people to ensure that you are secure.

According to a new Comparitech study published today, Q3 2026 saw the highest quarterly figures to date with 2,627 ransomware attacks in total – an average of nearly 29 per day. This is a 29 percent increase on Q2 2026 which logged 2,030 attacks in total, and a 61 percent increase on the same period last year (Q3 2025). 

Additional key findings include:

• Of 247 confirmed attacks:
  • 138 were on businesses
  • 53 were on government entities
  • 36 were on healthcare companies
  • 20 were on educational institutions
• Of the 2,380 unconfirmed attacks*:
  • 2,096 were on businesses
  • 71 were on government entities
  • 152 were on healthcare companies
  • 55 were on educational institutions
• Median ransom demand: $150,000 (average: $602,400)
• The most prolific ransomware gangs were Qilin and The Gentlemen

For full details, the research can be read here: https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment: 

“I’m often asked what I think lies ahead in the ransomware threat landscape, and it’s notoriously difficult to predict. Figures frequently fluctuate and a sector might see a bit of an increase one month, only to see a slight decrease the next month. However, Q3 2026 is different. We’re not seeing slight increases or decreases. We’re seeing significant increases across all key sectors.

Government agencies, healthcare providers, and the education sector all saw huge increases, as did the majority of business sectors. Seeing some of the most significant rises were tech companies (who often deal with multiple companies and are, therefore, a great central target for hackers), finance companies (who may also deal with a number of companies and/or store highly sensitive data), and utility companies (that form an integral part of our critical infrastructure). 

What’s also of note is hackers’ increasing attempts at triple extortion. They’re not only seeking to encrypt systems and steal data, but are also looking to target individuals/individual companies impacted in an attack. A prime example is The Gentlemen’s recent attack on MIP Holdings (a South African tech company). After being targeted by the group in June 2026, MIP paid a ransom to have stolen data deleted. Over the last few weeks, however, The Gentlemen has started adding MIP’s clients to its data leak site in a bid to get a ransom out of them, too. A key reminder that paying a ransom is absolutely no guarantee that your stolen data will be deleted!”

Comparitech researchers have published a new study looking at which countries are seeing the fastest growth in data centers. 

Data centers are, for the first time, being targeted in military conflicts as a means to disrupt daily life and damage economies. A Russian attack recently hit a Datagroup facility in Ukraine. A series of strikes by Iran in March damaged AWS facilities in both Bahrain and the UAE. A month later, an Oracle data centre in Dubai was damaged.

To find out how the data centre landscape was changing – and where these changes were concentrated – Comparitech analysed the concentration of and increases in data center numbers of 143 countries between 2023 and 2026. 

Key findings include: 

• The US saw the biggest increase in data centres (by numbers reported), rising from 5,300 in 2023 to 5,427 in 2026
• The Netherlands has the greatest concentration of data centres by landmass (8.9 per 1,000 km²) and population (16 per 1 million people)
• A quarter of the countries experiencing the highest data centre growth suffer from ‘extremely high’ water stress
• The US has more than 10 times more data centres than any other country
• Three of the top countries for data centre growth have an internet penetration of less than 50% of the population
• Five of the countries experiencing the highest data centre growth have more than doubled their data centre counts in the past three years

Read more here: https://www.comparitech.com/news/which-countries-are-seeing-the-fastest-growth-in-data-centres/

Comparitech researchers today published a study looking at August 2026 ransomware, finding that last month saw a record-breaking high for attacks at 32 attacks per day.

Key findings for August 2026

• 997 attacks in total — 77 confirmed attacks (confirmed by the entity involved)
• Of the 77 confirmed attacks:
  • 49 were on businesses
  • 18 were on government entities
  • 8 were on healthcare companies
  • 2 were on educational institutions
• Of the 920 unconfirmed attacks*:
  • 812 were on businesses
  • 21 were on government entities
  • 61 were on healthcare companies
  • 22 were on educational institutions
• The most prolific ransomware gangs were Qilin (157) and The Gentlemen (107)
• Qilin had the most confirmed attacks (12), followed by The Gentlemen (8)
• The US saw the most attacks (417), followed by Germany and Italy (48 each), the UK (36), and Canada (35)

Commenting on this study is Rebecca Moody, Head of Data Research at Comparitech: 

“Ransomware threats are escalating across most sectors and continue to have a devastating impact on those affected. One of August’s key attacks was on the government of Berlin, Germany. While the state government should be applauded for not meeting Rhysida’s ransom demand ($2.3M), the ransom looks set to be a drop in the ocean when compared to the costs the government is likely to face. Some recent statements suggest the computer rebuild could cost as much as €100 million (USD $116M) and the breach of over 1 million files is rumored to be the biggest state-level data breach in Germany to date.

Data relating to critical infrastructure is also believed to have been included in the Berlin breach. This, and the jump in attacks on utility companies, healthcare providers, manufacturers, and tech and finance companies, highlight how critical infrastructure remains a key target for hackers. By targeting these sectors, hackers are not only causing mass disruption by encrypting systems but they’re also gaining access to highly sensitive data, including personal data and information about critical systems and infrastructure.”

The full research can be read here: https://www.comparitech.com/news/ransomware-roundup-august-2026/