Ransomware attacks claimed on leak sites—where criminal groups post alleged victims—reached nearly 3,000 over summer 2026, according to researchers who track the field, representing what some estimates put at a 20 to 40 percent increase since spring. While exact numbers remain difficult to determine because victims don’t always disclose incidents and attackers inflate their claims, specialists who work to de-duplicate reports agree that claimed incidents have spiked in recent months, with overall ransomware attacks remaining consistently elevated in recent years.
Cynthia Kaiser, former FBI cyber deputy director who now leads research for anti-ransomware platform Halcyon, told Wired that international attacks fueled most of the recent increase, while U.S. numbers remained steady but high. “Internationally we’re seeing a lot more attacks. That to me is the really new part, and I do think it is in part fueled by AI,” Kaiser said.
Cybercriminals appear to be using large language models for specific parts of their attack operations rather than fully automated campaigns. Allan Liska, a ransomware researcher and threat intelligence analyst at Recorded Future, said criminals are relying on AI more heavily for creating phishing emails and in the negotiation process, though successful ransomware groups remain largely human-operated. “The fact that these groups are experimenting heavily with AI means that this could change going forward,” Liska said.
Fully AI-powered ransomware attacks have yet to emerge, which researchers attribute in part to existing criminal business models already working effectively.