Summary
- Comparitech recorded 1,020 ransomware incidents and claims, including 81 confirmed by affected organisations.
- Healthcare and education reached new monthly highs within the research company's monitored dataset.
- Germany and Spain were among the countries with the highest recorded totals, behind the United States.
Ransomware incidents and criminal claims exceeded 1,000 during October 2026 for only the second time this year, with new research recording particularly high activity across healthcare and education.
Cybersecurity research company Comparitech identified 1,020 incidents and claims during the month, compared with 823 in September and 1,034 in August.
Only 81 October incidents had been confirmed by the affected organisations. The remaining 939 were unconfirmed claims or reports, meaning the total should not be interpreted as 1,020 independently verified successful attacks.
Of the confirmed incidents, 39 affected businesses, 18 involved government entities, 10 concerned healthcare, and 14 affected educational institutions.
The wider unconfirmed dataset included 802 business cases, 75 healthcare cases, 33 education cases, and 24 government cases. Five additional claims could not be assigned to identifiable organisations.
The United States accounted for the largest national total, with 442 recorded incidents and claims. Germany followed with 52 and Spain with 30, placing two European countries among the most frequently represented locations.
Healthcare and education reach new monthly highs
Comparitech’s dataset recorded 85 incidents and claims involving healthcare organisations during October, exceeding the previous recent monthly high of 73 in August.
Education recorded 47, compared with 29 in September and 28 in August. The October figure also exceeded the previous high of 33 recorded in February 2025 within the research company’s monitoring period.
These totals include criminal group claims that have not been verified by the organisations named. Nevertheless, their distribution indicates where ransomware operators are publicly claiming activity and where confirmed incidents have been identified.
Healthcare organisations depend on clinical systems, patient information, diagnostic services, scheduling platforms, and specialised suppliers. An intrusion affecting those dependencies can interrupt treatment and create additional data protection and recovery requirements.
Educational institutions face different but substantial consequences, including the potential loss of administrative services, teaching resources, student records, and communications with families.
Both sectors may depend on external technology providers whose services support multiple organisations. A compromise affecting shared infrastructure can consequently have effects extending beyond the initially targeted system.
Manufacturing remained the most frequently represented business subsector in Comparitech’s October dataset, with 158 incidents and claims, despite recording fewer cases than in August.
Criminal groups continue to publicise victims
The Gentlemen and Qilin were the most prolific ransomware groups identified during October, with 139 and 125 recorded claims respectively.
Each group was linked to eight incidents confirmed by the affected organisation. The difference between those figures illustrates the limitations of relying on criminal leak-site activity as a direct measure of verified compromise.
Ransomware groups may publish victim names before an organisation acknowledges an intrusion, issue claims long after the original incident, or exaggerate the extent of a compromise.
Comparitech’s methodology treats an incident as confirmed where an affected organisation publicly acknowledges ransomware or confirms a cyberattack corresponding to a criminal group’s claim.
That definition allows figures to change retrospectively. A claim recorded in one month may later be assigned to an earlier period when the underlying attack date becomes known.
Rebecca Moody, Head of Data Research at Comparitech, expressed concern about the October increase and the record levels observed in healthcare and education. Her accompanying analysis also highlighted attacks on shared service providers, where a central compromise can expose customers and other dependent organisations.
Such incidents complicate the separation between an organisation’s own security controls and the resilience of systems operated on its behalf. Hosting, cloud services, identity platforms, and outsourced technology management all create dependencies that can influence operational recovery.
Comparitech’s October figures show renewed growth after September’s decline, although most recorded cases remain unconfirmed. Subsequent disclosures and revisions to attack dates may change the final monthly totals.
