Industrial Sector Drives Ransomware Surge in Third Quarter
Cyberattacks on critical infrastructure rose 23% quarterly despite a late summer drop in monthly activity.
- By Jesse Jacobs
- Oct 21, 2026
Ransomware attacks jumped 23% in the third quarter of 2026, according to the latest NCC Group Monthly Threat Pulse report, driven by threats targeting industrial organizations and critical infrastructure.
Quarterly totals climbed despite a 26% month-over-month decline in September, which recorded 821 incidents globally. North America experienced 390 recorded attacks during the month, followed by Europe with 211.
The industrial sector endured 838 attacks throughout the quarter—exceeding the consumer discretionary sector by 526 incidents. Analysts attribute the gap to actors using hybrid tactics to cause operational disruption across energy, transportation and healthcare networks.
A four-day outage at a British power facility underscored these risks. The intrusion involved internet-exposed programmable logic controllers and compromised operational technology systems accessed through remote maintenance pathways.
Threat actors also expanded their use of artificial intelligence. Analysts identified BraZetsu, a framework designed to streamline exploitation by using automated models to profile victims, triage data and prioritize targets based on commercial value.
Legitimate agentic AI deployments also faced risks from excessive permissions, system misalignment and prompt injection vulnerabilities. Affected entities included government systems and healthcare institutions.
Qilin emerged as the most active threat group with 365 attacks, followed closely by The Gentlemen with 359 incidents.