The Numbers
Our monitoring tracked over 2,100 new victim disclosures across 48 active leak sites in Q1 2026 — a 15% increase on Q4 2025. Active ransomware groups rose to 131, with 19 new groups emerging.
Key Trends
- Larger groups splintering into smaller, agile cells
- AI-assisted social engineering and phishing lure generation
- Triple extortion growing — threatening regulators, customers, partners
- Healthcare and education disproportionately targeted
- Exploited internet-facing devices overtaking phishing as primary entry
Contact us at info@binary-response.com for bespoke threat intelligence briefings.