Ransomware Is Up Nearly 50%, and Small Businesses Are Taking Most of It
Ransomware had its busiest quarter in over a year, and the typical victim is not a bank or a hospital chain. It is a manufacturer, an IT firm or a professional services company with fewer than 200 people. Here is what the Q3 2026 numbers show, why backups alone no longer save you, and the short list of controls that matter most.
IrenicTech · · 6 min read
Ransomware is usually reported as a big-company story: a hospital chain, an airline, a household brand. The numbers say otherwise.
NordLayer, which tracks more than 200 ransomware leak sites, counted 2,894 attacks between July and September 2026. That is nearly 50% more than the same quarter last year, 8.6% more than the quarter before, and the busiest three months in over a year. And about two in three of those victims had 200 employees or fewer.
If you run a business of that size, you are not too small to be worth it. You are the main market.
What the Q3 2026 numbers show
| What NordLayer measured (Q3 2026) | Result |
|---|---|
| Total attacks | 2,894, up from 1,933 in Q3 2025 |
| Change from Q2 2026 | Up 8.6% |
| Victims with 200 employees or fewer | About two in three |
| Companies with 11 to 200 staff | Nearly half of all attacks |
| Top target country | United States, 805 attacks |
| Most hit industries | Manufacturing (347), IT (210), professional services (153) |
| Fastest growing industry | Healthcare, 150 attacks, up 30% |
| Most active groups | The Gentlemen (383), Qilin (363), INC Ransom (110) |
A note on how this is counted. Every ransomware tracker, NordLayer included, counts victims that criminals name on their leak sites, because most victims never announce an attack. So the real figure is almost certainly higher, and the totals vary between trackers. They all agree on the direction.
Why small businesses keep getting hit
Ransomware groups run like businesses, and a business picks customers it can close.
A company with 50 to 200 staff usually has real revenue, customer data worth something, and systems it cannot run without for a week. It rarely has a security team, a person watching alerts at night, or a tested plan for the day the screens go dark. NordLayer describes companies with five to fifty million dollars in revenue as the sweet spot: big enough to pay, small enough to break into.
Manufacturing tops the list for the same reason. A factory that cannot run its production schedule, or a supplier that cannot ship, loses money every hour, and that pressure is exactly what the ransom note is built to use.
The shift that changes your defence: steal first, encrypt maybe
The classic ransomware attack locked your files and sold you the key. Good backups were the answer: restore and move on.
That answer is weaker now. NordLayer reports that more extortion groups skip encryption and simply steal data, then threaten to publish it. As one Nord Security expert put it, stealing data is faster and simpler, so one group can hit many victims at once with far less effort.
A backup gets your systems running again. It does nothing about your customer list, your contracts or your staff records appearing on a leak site. So backups are still essential, but the real defence moves earlier: keeping attackers out, and noticing quickly when they get in.
Your suppliers are part of your attack surface
In October 2026, a new group called n0n listed more than 40 port authorities, maritime and shipping companies across 18 countries on its leak site. Security firm CyDome found that half of them are known customers of one maritime IT platform provider, whose website had been down for weeks. That provider has not confirmed it was the source, but the pattern is a familiar one: breach one supplier with access to many customers, and you get all of them.
Most small businesses have at least one of these: an IT support firm with remote access, a software vendor that can connect to your systems, an accountant or payroll provider with your logins. Each is a door you did not build and cannot fully see.
Where ransomware actually gets in
The reassuring part of all this is that the entry points have barely changed. Attackers use the doors that are already open:
- Remote access with a weak or stolen password. VPNs, remote desktop and remote support tools exposed to the internet, protected by a password alone.
- Internet-facing systems that are not patched. Firewalls, VPN appliances, web servers and file transfer tools with known, exploited flaws. CISA adds new ones to its Known Exploited Vulnerabilities catalog almost every week. PHP2Shell, exploited this October before most servers were patched, is a typical example.
- Phishing and tricked staff. An email that drops malware, or a convincing message or call that gets someone to hand over a login, which is how the ASOS breach began.
- Suppliers. A managed IT provider, software vendor or contractor whose access to you gets compromised. The same goes for the platforms your apps run on: this month Railway, Zeabur and TiDB Cloud all disclosed breaches.
What to do this month
None of this needs an enterprise budget. It needs someone to own it.
- Put phishing-resistant multi-factor authentication on every remote access route and every admin account. Passkeys or security keys where possible. If remote desktop is open to the internet, close it and put it behind a VPN or a zero-trust access tool.
- Know what you expose to the internet, and patch it first. Make a list of every system reachable from outside: firewall, VPN, website, email, file sharing, remote support. Those get patched within days of a critical fix, not at the next maintenance window.
- Make backups attackers cannot delete, and test them. At least one copy offline or immutable, separate from your normal admin accounts. Do a full restore of one important system this month, and time it.
- Limit what one stolen login can reach. Separate admin accounts from everyday ones, remove access people no longer need, and do not let one account touch everything.
- Review supplier access. For each supplier that can connect to your systems: what can they reach, is it protected with MFA, and would you know if they logged in at 3 a.m.?
- Write a one-page incident plan. Who to call, who decides, how to reach staff if email is down, where the backups are, and who talks to customers. Print it. Ransomware tends to take the shared drive with it.
The FBI and other law enforcement agencies advise against paying ransoms. Payment does not guarantee working decryption or deleted data, and it marks you as a business that pays. The best way to avoid that decision is to never be cornered into it.
How this connects to the bigger picture
Ransomware is the most expensive version of a trend we keep writing about: attackers increasingly log in with credentials that work rather than breaking in. If you are thinking about outsourcing detection, our post on what agentic SOCs really do separates the vendor claims from the evidence.
Want to know how exposed you are?
The fastest way to find the doors ransomware uses is to try them. Our VAPT service tests your internet-facing systems, web apps, APIs and cloud the way an attacker would, scores every finding with CVSS so you fix the worst first, retests for free once you have, and gives you a signed letter for clients and insurers. Our security and compliance and cloud infrastructure teams handle the follow-through: access reviews, logging, and backups you can actually restore from.
Tell us what your business runs on and book a discovery call. We will tell you where you are most exposed, and what to fix first.
Part of our guide to AI security.
Sources: NordLayer's ransomware statistics (Q3 2026 figures), Insurance Journal's report on NordLayer's Q3 findings (27 October 2026), and the Risky Business bulletin on the n0n maritime supply-chain attack, citing CyDome. Verified against these sources on 27 October 2026.
Frequently asked
How many ransomware attacks were there in Q3 2026?
NordLayer, which monitors more than 200 ransomware leak sites, counted 2,894 attacks between July and September 2026. That is nearly 50% more than the 1,933 it counted in Q3 2025 and 8.6% more than Q2 2026, making it the busiest quarter in over a year. Other trackers counted slightly different totals, because they all count victims named on criminal leak sites rather than independently confirmed attacks, but they agree on the direction.
Are small businesses really the main ransomware target?
Yes, by count. NordLayer found about two in three Q3 2026 victims had 200 employees or fewer, and companies with 11 to 200 staff absorbed nearly half of all attacks. Large companies make the headlines because they are big names, but most victims are businesses with enough revenue to pay a ransom and not enough security staff to stop the attack. NordLayer describes the five to fifty million dollar revenue range as the sweet spot.
Which ransomware groups are most active right now?
In Q3 2026, NordLayer attributed 383 attacks to The Gentlemen and 363 to Qilin, together nearly 750 of the quarter's total. INC Ransom followed with 110. The groups change often as law enforcement takes them down and their members regroup under new names, which is why defending against how ransomware gets in is more useful than tracking who is behind it.
If I have backups, am I safe from ransomware?
Backups are essential, but they are no longer enough on their own. More groups now steal data and threaten to publish it, sometimes without encrypting anything. A backup restores your systems but cannot un-leak your customer list, contracts or employee records. Backups also only help if attackers cannot delete them, so keep at least one copy offline or immutable, and test a full restore before you need one.
How does ransomware usually get into a small business?
Most often through a door that is already open: a remote access system (VPN, remote desktop, a remote support tool) signed into with a stolen or guessed password, an internet-facing system that has not been patched, a phishing email that lands malware or harvests a login, or an IT supplier whose access to your network gets compromised. In October 2026, a ransomware group listed more than 40 maritime and shipping companies after apparently getting in through a shared IT services provider.
Should a small business pay a ransomware demand?
Law enforcement agencies, including the FBI, advise against paying. Payment does not guarantee you get working decryption or that stolen data is deleted, it marks you as a business that pays, and in some cases it can breach sanctions rules. The decision is easier when you never have to make it: tested backups, a written incident plan, and a security contact you can call on day one turn a ransomware attack from an existential crisis into a bad week.
Read us on Google
Make IrenicTech a preferred source.
Tell Google you want our work first. It takes one tap, and IrenicTech is favoured in your Top Stories, AI Mode, and AI Overviews whenever you search the topics we write about.
Add to preferred sources
