Summary
- Cohesity’s latest figures suggest a 60% quarterly and 42% annual rise in UK ransomware activity.
- Two groups are reported to account for roughly one-third of UK cases in the dataset.
- Reported incidents and claims should not automatically be treated as verified successful attacks.
UK ransomware activity has risen substantially in a new set of figures attributed to Cohesity, with reports of a 60% increase from the previous quarter and 42% growth compared with the same period a year earlier. Published on 12 October, the figures also suggest that two groups account for around a third of the observed UK activity.
The numbers indicate a changing distribution of reported ransomware activity, with Europe receiving growing attention as US volumes in the dataset decline. The available reporting does not, however, support a simple conclusion that every entry represents an independently confirmed successful attack. Ransomware datasets may draw on public victim disclosures, criminal leak sites, and other intelligence sources, each with different verification and completeness limitations.
It is therefore important to distinguish the number of claims made by attackers from incidents that victims, authorities, or investigators have confirmed. Leak-site listings may describe real theft, but they can also repeat old incidents or overstate the scope of access. At the same time, many genuine attacks never become public through those sources, particularly when a victim is not named by the criminals involved.
An increase measured over one quarter can also be influenced by the previous quarter’s baseline, collection coverage, and the rate at which incidents are discovered. The 60% change is a finding attributed to this particular dataset. It should not be treated as an independently established increase across every UK organisation or as a forecast for the remainder of 2026.
Concentration among criminal groups
Qilin accounted for 19% and The Gentlemen for 13% of the UK ransomware activity tracked in the reported Cohesity figures, making the two groups responsible for almost a third of the dataset’s UK total. Ransomware brands are nevertheless imperfect indicators of the people conducting attacks. Affiliate models allow operators to move between services, adopt new names, and use infrastructure shared across different criminal businesses.
This complicates comparisons from quarter to quarter. A group that disappears from a leak site may not have ceased operating; its affiliates may have migrated to another brand. Similarly, a rise in postings by one operation can reflect changes in its publication practices rather than a matching rise in initial compromises.
UK organisations exposed to ransomware include private companies, service providers, and public bodies. Outcomes differ substantially. An intrusion can lead to encryption, theft, extortion without encryption, or a combination, while disruption can continue after technical restoration through legal review, customer communications, and assessment of records that may have been accessed.
The publication also discusses how artificial intelligence could help criminals scale portions of their operations. AI may accelerate preparation of convincing messages, scripting, or the processing of stolen information. It does not follow that the attacks in the reported dataset were individually conducted by autonomous systems; the figures are not a measurement of AI use by attackers.
Other research on international ransomware activity has produced different geographic distributions. Differences in sample population, country allocation, and counting rules mean competing estimates cannot simply be combined into a single market-wide total.
Geographic attribution is another methodological challenge. A multinational victim may be recorded under its headquarters country even if the affected infrastructure is elsewhere, while a supplier incident can generate claims involving several customers. Unless those rules are transparent, the percentages cannot be converted into a precise count of UK systems encrypted or financial losses suffered. The reported changes are best understood as measures within the selected intelligence dataset.
Cohesity’s reported observations show a higher UK count than in previous comparable periods and substantial concentration around two ransomware groups. A definitive assessment of the trend requires the underlying data collection methodology, the treatment of duplicate claims, and the share of incidents independently verified.
