✅ Report Title: Ransomware Landscape in H1 2026: Statistics and Key Issues

✅ Executive Summary

• This report analyzes the activities of ransomware groups in the first half of 2026 (from January 1, 2026 to June 30, 2026).
• The subjects of analysis are ransomware leak sites operated by ransomware groups and the ransomware victim organizations and companies whose data were uploaded to leak sites.
• In the first half of 2026, ransomware infections of 5,984 organizations were posted on leak sites.
  • Compared to the first half of 2025 (2025-01-01 to 2025-06-30), the total number of victim organizations increased by 1,555.

📌 Active Group Overview

• A total of 119 ransomware groups were active in the first half of 2026, with each group attacking an average of approximately 25 organizations.
• In the first half of 2026, a total of 44 new ransomware groups emerged, with the highest number of groups appearing in February and April, totaling 9 new groups.

📌 Ransomware Victims

• The Top 10 countries affected by ransomware in the first half of 2026 were selected, and based on the number of affected companies, the country most impacted was the United States.
  • Compared to 2025, the United States had the largest increase in ransomware victims in the first half of 2026, while Monaco experienced the greatest decrease.
• The Top 10 industries affected by ransomware in the first half of 2026 were identified, and the industry that suffered the greatest damage during the first half of 2026 was the Manufacturing industry.
• In the first half of 2026, ransomware incidents targeting South Korea totaled 36 cases, up more than 3.3 times from the same period last year.
  • The ransomware threat to South Korea is not a temporary phenomenon; rather, it is evolving into a form where multiple ransomware groups continuously include South Korean companies as targets.

📌 Risk Assessment

• As a result of S2W's Threat & Security Intelligence Department's independent risk assessment of ransomware groups, Qilin, PLAY, LockBit, Interlock, and INC were selected as the Top 5 high-risk ransomware groups for the first half of 2026.