The IT Nerd

Comparitech researchers today published a study looking at August 2026 ransomware, finding that last month saw a record-breaking high for attacks at 32 attacks per day.

Key findings for August 2026

• 997 attacks in total — 77 confirmed attacks (confirmed by the entity involved)
• Of the 77 confirmed attacks:
  • 49 were on businesses
  • 18 were on government entities
  • 8 were on healthcare companies
  • 2 were on educational institutions
• Of the 920 unconfirmed attacks*:
  • 812 were on businesses
  • 21 were on government entities
  • 61 were on healthcare companies
  • 22 were on educational institutions
• The most prolific ransomware gangs were Qilin (157) and The Gentlemen (107)
• Qilin had the most confirmed attacks (12), followed by The Gentlemen (8)
• The US saw the most attacks (417), followed by Germany and Italy (48 each), the UK (36), and Canada (35)

Commenting on this study is Rebecca Moody, Head of Data Research at Comparitech: 

“Ransomware threats are escalating across most sectors and continue to have a devastating impact on those affected. One of August’s key attacks was on the government of Berlin, Germany. While the state government should be applauded for not meeting Rhysida’s ransom demand ($2.3M), the ransom looks set to be a drop in the ocean when compared to the costs the government is likely to face. Some recent statements suggest the computer rebuild could cost as much as €100 million (USD $116M) and the breach of over 1 million files is rumored to be the biggest state-level data breach in Germany to date.

Data relating to critical infrastructure is also believed to have been included in the Berlin breach. This, and the jump in attacks on utility companies, healthcare providers, manufacturers, and tech and finance companies, highlight how critical infrastructure remains a key target for hackers. By targeting these sectors, hackers are not only causing mass disruption by encrypting systems but they’re also gaining access to highly sensitive data, including personal data and information about critical systems and infrastructure.”

The full research can be read here: https://www.comparitech.com/news/ransomware-roundup-august-2026/

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) yesterday announced an investigation into a “major” cybersecurity incident that the Qilin ransomware group claimed responsibility for. Given that is is Qilin, that’s all that needs to be said really.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“We recorded a significant uptick in the number of Qilin’s claims last month. Qilin claimed responsibility for the second-most data breaches out of all ransomware gangs in July, second only to the Gentlemen. Many of Qilin’s attack claims have proven credible. Most experts believe Qilin is based in Russia, which raises further questions about national security and what data was exposed.”

If you want to see more details on the Comparitech report that is being referred to, here you go: https://www.comparitech.com/news/ransomware-roundup-july-2026/

UPDATE: The ATF has since confirmed a breach of one standalone, isolated system that was quickly disconnected, and says its enterprise network, eForms system, and core mission functions were not affected. Qilin listed the ATF on its leak site on August 26 but hasn’t posted the screenshots or stolen documents it typically shares as proof, and the DOJ has designated it a “major incident,” which triggers mandatory federal reporting.

Adrian Culley, offensive security engineer at SafeBreach had this to say:

“ATF’s claim that the compromised system “operates separately from the ATF enterprise network” is the detail worth testing rather than accepting at face value. A genuinely standalone system with no route out has no way to hand data to Qilin’s leak site — so either that isolation has a gap nobody has mapped yet, or the segmentation held and what Qilin is holding is thinner than the leak posting implies. Both are worth knowing before this gets filed as contained.

Qilin’s tradecraft favours exploiting internet-facing systems for initial access (T1190) before attempting lateral movement (T1021) toward whatever segment holds value. That a federal law enforcement agency runs a system isolated enough to survive contact with its enterprise network is good practice. Whether that isolation has actually been tested against an actor trying to break out of it is a separate question, and the more important one.

Owning a segmentation boundary and knowing it holds under a live attack path are not the same claim. Before this incident is closed out, I am sure that the ATF’s own investigators will be running the same lateral-movement techniques Qilin favours against that boundary directly, rather than relying on logs that simply show no crossing occurred.

According to new findings, The Gentlemen gang has claimed responsibility for 675 ransomware attacks, with 600 of these occurring in 2026 so far. This makes The Gentlemen the second-most dominant strain after Qilin. 

The study furthermore breaks down The Gentlemen’s RaaS model, its victims by sector and industry, and its most targeted countries. 

Commenting on this study is Rebecca Moody, Head of Data Research at Comparitech: 

“In less than a year, The Gentlemen has become one of the most dominant groups of recent times — both in terms of the high volume of attacks carried out and the widespread disruption caused by its attacks. 

Its success stems from a number of things, including its rapid exploitation of new vulnerabilities, its collaboration with Breach Forums, and its being an attractive prospect for affiliates. The latter is thanks to the high rewards affiliates are offered: 90% of the ransom payouts, compared to 70 to 80% on average. It’s also targeting a plethora of companies across a wide range of countries and sectors. Other prolific gangs, like Qilin, have a far higher concentration of victims within the US. Avoiding the most ‘saturated’ markets and focusing on less-targeted countries has perhaps increased its success rate. 

At the time of writing, The Gentlemen has claimed 57 new victims this month already (not included in our report stats), meaning it’s on target for a third month of 100+ victims.”

You can read the full report here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Content Management Systems (CMSs) power millions of websites worldwide, making them one of the most common ways to publish content online. Because many CMS users have limited cybersecurity expertise, the security protections enabled by default can play an important role in reducing risk.

In a study published today, Comparitech researchers took a look at four of the most popular open-source CMSs (WordPress, Drupal, Joomla, and Ghost), to determine which has the strongest out-of-the-box security. The CMS platforms were assessed immediately following installation to determine their secure-by-default posture, with the assessment considering browser security controls, information disclosure, authentication securiy, and API and enumeration exposure. 

Key findings include: 

• WordPress had the weakest out-of-the-box security protections, with a score of 8 out of 100
• Drupal achieved the highest overall score (27.1 out of 100) – note that none of the tested CMSs provided a particularly strong security posture immediately after installation
• Joomla has had the greatest number of disclosed vulnerabilities in the past five years
• Drupal recorded the highest number of high- and critical-severity core vulnerabilities between 2021 and 2025
• WordPress has the largest extension ecosystem, which may increase exposure to security risks associated with third-party plugins

For full details, please see the research here: https://www.comparitech.com/news/which-cms-platforms-provide-the-strongest-out-of-the-box-security/

With ransomware attacks plaguing businesses and individuals around the world, Comparitech have released their Ransomware Roundup for July 2026, finding that last month saw nearly 26 ransomware attacks per day. 

The research looks into attacks by sector, most prolific groups and attacks by country.

Key findings include:

• 799 attacks in total — 51 confirmed attacks (confirmed by the entity involved)
• Of the 51 confirmed attacks:
  • 31 were on businesses
  • 10 were on government entities
  • 3 were on healthcare companies
  • 7 were on educational institutions
• Of the 748 unconfirmed attacks*:
  • 657 were on businesses
  • 24 were on government entities
  • 50 were on healthcare companies
  • 16 were on educational institutions

You can find the full research here: https://www.comparitech.com/news/ransomware-roundup-july-2026/

Commenting on this is Rebecca Moody, Head of Data Research at Comparitech:

“If we needed a reminder of how dominant a threat ransomware attacks remain, July’s figures provide us with just that. Figures reached the third-highest level in the last 17 months and The Gentlemen and Qilin continued to add hundreds of victims to their data-leak sites. We’ve already logged over 100 victims during the first four days of August 2026, too. 

July also saw some of the year’s most significant ransomware attacks. This includes the attack on the Romanian government’s land registry agency, which saw an entire database being wiped, the crippling attacks on AnMed and Fairlife in the US, and the attack on The Craneware Group, which looks set to have resulted in an extensive data breach. 

These attacks highlight how ransomware groups hit organisations in various different ways — taking down key systems, stealing troves of data, and even deleting massive datasets. Never has it been more important for organisations to ensure they’re carrying out regular backups (and backups of their backups!) so they can reset systems and restore data as quickly as possible if the worst does happen.”

I would put aside some time to give this a read as it will help you to structure your defenses.

Comparitech researchers have published an update to their 2023 study on the cost of cybercrime globally. The new study sees a significant increase in the annual estimated monetary impact of cybercrime — now at $1.24 trillion versus 2023’s figure of $714 billion. 

Key findings include: 

• 103.9 million people fall victim to cybercrimes globally each year, or more than 1,577 victims per 100,000 people
• The average victim loss is $9,468 per crime
• Victims lose an estimated $1.24 trillion to cybercrime annually
• The United States showed the biggest estimated losses at 6.7 million victims losing an estimated $138.9 billion

For full details, click here.

Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people.

Commenting on this is Rebecca Moody, Head of Data Research at Comparitech: 

“This is another prime example of why third-party healthcare companies, like medical billing providers, have become a prime target for ransomware groups. By targeting one entity, they’re gaining access to multiple healthcare providers and their data. Our recent H1 healthcare ransomware report found a 35 percent uptick in attacks on these types of companies (those that specialize within the healthcare sector but don’t provide direct care). This breach becomes the second-largest on a third-party healthcare business following a ransomware attack in the last 18 months.”

The report that was linked is a very good one, and I encourage you to read it if you get a chance.

UPDATE: Additional commentary comes via Seemant Sehgal, Founder & CEO, BreachLock:

   “A breach that ran for four days in September 2025 and surfaced in a public disclosure eight months later tells you something about how difficult incident response and forensic review are in environments that handle data across multiple providers simultaneously. The data types here, Social Security numbers, insurance details, medical information, are the combination that makes downstream fraud viable for years, which means the harm timeline for affected individuals extends well beyond the notification date. Eight months is a long time for that data to be in motion before patients knew to watch for it.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “One of the things I absolutely hate about stories like this is that the default response is almost always complimentary identity protection services. Yes, those services can detect some types of fraud, but they don’t come close to addressing the full range of risks created by a data breach. They have value, but they’re far from a complete solution.

   “I’ve started calling this the information security equivalent of thoughts and prayers. It’s the absolute bare minimum a company can offer after a breach without making meaningful changes to improve security or reduce future risk. The reality is that only a fraction of affected people will ever enroll in those services, and even those who do aren’t protected against every way their information can be abused. It’s frustrating because organizations can suffer a major breach, offer a year of identity protection, and too often that’s treated as an adequate response instead of a starting point for real accountability.”

Damon Small, Board of Directors, Xcape, Inc.:

   “Third-party healthcare billing breaches create massive regulatory exposure and systemic supply chain liability when basic detection and response controls fail. The intrusion at Medical Business Office Systems, known as MCBS, allowed attackers to dwell for days and exfiltrate over three terabytes of sensitive patient and insurance data undetected, exposing non-existent data loss prevention and egress monitoring capabilities.

   “Furthermore, an eight-month delay before patient notification, justified by waiting for internal investigation completion, highlights severely flawed incident response processes. Security leaders must mandate continuous network egress monitoring, enforce strict data loss controls on revenue cycle aggregators, and require business associates to report material intrusions within days rather than waiting for post-forensic completion.

   “Critical Takeaways

• Monitor large-scale data egress: Deploy continuous network monitoring and data loss prevention tools to detect abnormal outbound traffic before terabytes leave the perimeter.
• Accelerate incident response SLAs: Mandate that third-party vendors establish tight notification timelines rather than withholding breach disclosures for months while conducting internal reviews.
• Enforce vendor risk accountability: Require revenue cycle partners to submit to regular security telemetry audits and maintain strict field-level data controls for sensitive patient records.

   “If it takes eight months to realize three terabytes of patient data walked out the door, your incident response plan is a post-mortem, not a defense.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “MCBS had a regulatory shortcut available that would have made this entire disclosure unnecessary. The Health Insurance Portability and Accountability Act (HIPAA) includes a breach notification safe harbor for properly encrypted data, meaning if those 1.26 million Social Security numbers had been encrypted at the field level, the stolen files would have been useless ciphertext and the breach wouldn’t have triggered notification requirements. The encryption was always the cheapest fix. MCBS chose not to implement it when the rule calls encryption “addressable” rather than mandatory.

   “The Department of Health and Human Services proposed eliminating that flexibility in January 2025, making AES-256 encryption at rest mandatory for all electronic protected health information. That rule hasn’t been finalized, and final action has been pushed to July 2027. Encryption remains “addressable” today, and every healthcare billing company that reads “addressable” as “optional” is sitting on the same exposure MCBS had.

   “Credit monitoring as a remedy tells you what the breach responders think the threat model is, and they’re thinking too narrowly. PEAR (Pure Extraction and Ransom) exfiltrated 3.3 terabytes from MCBS, including medical histories, mental health conditions, and diagnosis information. That data enables targeted blackmail, insurance manipulation, and employment discrimination. A credit freeze catches none of it.

   “Under the EU’s General Data Protection Regulation (GDPR) Article 82, affected individuals can claim compensation directly from the company that lost their data. The US gives 1.26 million people a year of free credit monitoring instead. A $4 trillion industry can afford field-level encryption, and it can afford direct liability to patients when it skips it.”

The dental benefits administrator DentaQuest has started issuing notification letters to individuals affected by a May 2026 cybersecurity incident. The number of affected individuals has yet to be confirmed, although DentaQuest has confirmed that at least 15 million individuals have been affected.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“This is a major data breach both in terms of the number of people affected and the types of personal information involved. DentaQuest customers should take advantage of free credit monitoring offered by DentaQuest and monitor their credit reports, bank accounts, and medical bills for unrecognized activity. Whether or not DentaQuest paid ShinyHunters’ ransom demand, there is no guarantee that the group will delete the stolen data. Breach victims should assume the worst and act accordingly to protect their accounts and identities.”

Comparitech recently published an in-depth research study looking at ransomware attacks against healthcare institutions in the first half of 2026, finding that attacks increased nearly 14% since the last half of 2025. 

Comparitech has published a new study looking at ransomware attacks against the education sector in H1 2026, finding that while overall attacks against educational institutions declined, attacks on higher education actually increased. 

Key findings include: 

• 104 attacks in total
• 36 confirmed attacks
• 68 unconfirmed attacks
• Nearly 693,000 records are known to have been breached in the confirmed attacks
• Median ransom demand: $420,620 – up 53% from $275,000 in H2 2025
• The ransomware strains that made the most attack claims were The Gentlemen and Qilin (15 each), LockBit (9), Interlock and Nova (6 each)
• The Gentlemen claimed the most confirmed attacks (6), followed by Interlock (4) and Qilin and LockBit (3 each)

For full details, the research can be read here: https://www.comparitech.com/news/education-ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-data-breaches/ 

Comparitech researchers have published a new study looking at ransomware attacks targeting the government sector in H1 2026. 

According to the findings, Comparitech researchers logged an average of one ransomware attack on a government entity every day. Attacks jumped by over 13 percent when compared to H2 2025, increasing from 165 to 187 attacks. 

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment: 

“Predicting what’s going to happen within the ransomware threat landscape for the rest of the year is always difficult. However, based on our H1 2026 data and the increased momentum of The Gentlemen, ransomware attacks within the government sector remain a dominant, if not growing, threat. From weeks-long disruptions due to system encryption to extensive data breaches, governments are the ideal target for hackers.

The ongoing attack on Latvia’s state forestry company (LVM) should also serve as a reminder that government agencies have to ensure they’re meeting the basic cybersecurity best practices. In LVM’s case, hackers were able to exploit a vulnerability in a system that hadn’t been updated in two years. Keeping systems up to date, patching vulnerabilities as soon as they’re flagged, carrying out regular backups, and making sure employees are regularly trained and are on high alert at all times are crucial to mitigating the risks of attacks.”

You can read the details here: https://www.comparitech.com/news/government-ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-data-breaches/