Ransomware Attacks Double Year over Year as July 2026 Cyber Threat Volumes Continue to Rise Worldwide

Global cyberattacks increased by 16% year over year in July 2026, while reported ransomware victims surged by 87%, according to Check Point Research. The figures highlight growing pressure on organisations as cybercriminals expand their operations and exploit weaknesses across digital infrastructure.

Cybersecurity threats continued to rise worldwide in July 2026, with organisations facing an average of 2,336 cyberattacks per week, according to the latest Global Threat Intelligence report from Check Point Research.

The findings reveal a 3% increase compared with June and a 16% rise compared with July 2025. However, ransomware emerged as one of the most significant developments during the month, with 964 reported victims, representing an 87% year-over-year increase.

The report suggests that organisations are dealing with several overlapping risks, including ransomware, phishing, software vulnerabilities and the growing exposure of sensitive information through generative artificial intelligence tools.

Ransomware Activity Surges Worldwide

Ransomware activity accelerated sharply in July, breaking from the comparatively stable pattern observed during the first half of 2026.

Check Point Research recorded 964 reported ransomware victims during the month, up 49% from June. During the first six months of the year, monthly ransomware activity averaged approximately 672 reported incidents.

Ransomware attacks typically involve criminals gaining access to an organisation’s systems, encrypting data or threatening to publish stolen information unless a payment is made. Many groups now use double extortion, combining data theft with encryption to increase pressure on their victims.

Business Services was the most affected sector in July, accounting for 32.5% of reported victims. Industrial Manufacturing followed with 14.4%, while Consumer Goods and Services represented 13.4%.

These industries can be attractive targets because disruptions may affect customer operations, production, supply chains and access to essential business information.

It is important to note that the figures are based on publicly reported ransomware victims, including disclosures on criminal leak sites. They do not represent every ransomware incident worldwide.

Global Cyberattacks Continue to Increase

Beyond ransomware, the broader cyber threat landscape remained under pressure.

Organisations experienced an average of 2,336 attacks per week in July, with the global figure increasing by 16% compared with the same month in 2025.

Education remained the most targeted industry, recording an average of 4,848 weekly attacks per organisation, an increase of 14% year over year.

Government ranked second, with 3,044 weekly attacks, followed by telecommunications with 2,927. Energy and utilities also experienced a significant increase, while hospitality, travel and recreation entered the five most targeted sectors.

The findings underline the exposure of organisations that manage large amounts of personal information, provide essential services or operate complex digital infrastructures.

Africa Records High Levels of Cyber Threat Activity

African organisations experienced an average of 3,237 cyberattacks per week in July, significantly above the global average of 2,336.

The report placed Africa behind Latin America and the Asia-Pacific region in average weekly attack volume. Nevertheless, the figures demonstrate the continued pressure on organisations across the continent.

Angola recorded an average of 5,714 weekly attacks per organisation, followed by Nigeria at 4,975, Kenya at 2,915 and South Africa at 2,195.

These figures reflect the report’s observed attack activity rather than the number of successful breaches or the total number of victims in each country.

As businesses and public institutions continue to expand their use of digital services, maintaining secure networks, protecting customer information and responding quickly to suspicious activity remain important priorities.

Phishing Continues to Provide an Entry Point for Attackers

Email remains a significant route through which cybercriminals attempt to gain access to corporate systems.

Check Point Research reported that one in every 128 emails worldwide was classified as phishing in July. In Africa, the rate was higher, at approximately one in every 106 emails.

Phishing messages often impersonate banks, suppliers, government agencies or colleagues to persuade recipients to reveal passwords, download malicious files or approve fraudulent transactions.

Once an attacker obtains valid credentials, they may attempt to access additional systems, steal sensitive information or deploy ransomware.

Organisations can reduce these risks by using multifactor authentication, filtering suspicious emails, training employees to identify fraudulent messages and monitoring unusual account activity.

Generative AI Creates New Data Security Challenges

The report also highlights the growing security risks associated with enterprise adoption of generative AI.

Organisations used an average of eight generative AI tools, while individual users generated approximately 95 prompts during July.

Check Point Research found that one in every 36 prompts carried a high risk of exposing sensitive information. Personal information, financial data and network infrastructure details were among the categories identified in its analysis.

The concern is that employees may unintentionally enter confidential customer records, internal documents or proprietary business information into AI applications without understanding how that information is processed or protected.

Businesses therefore need clear policies governing AI usage, appropriate access controls and safeguards that help prevent sensitive data from being shared with unauthorised services.

The findings suggest that AI security is becoming part of the wider cybersecurity challenge rather than remaining a separate issue.

How Organisations Can Reduce Their Exposure

The increase in reported ransomware victims reinforces the importance of a layered cybersecurity strategy.

Organisations should regularly update operating systems and applications, secure remote access, enforce multifactor authentication and monitor privileged accounts. Regular vulnerability assessments can help identify weaknesses before criminals exploit them.

Reliable offline or immutable backups are also important, as they can support recovery if systems are encrypted or disrupted. Businesses should test their recovery procedures rather than assuming that backups will always be available when needed.

Security teams should also monitor email activity, cloud environments and endpoints for suspicious behaviour. A documented incident response plan can help organisations contain attacks, investigate their causes and restore affected services more efficiently.

For companies using generative AI, employee training and clear data-handling policies can reduce the risk of accidental information exposure.

Conclusion

July 2026’s cybersecurity figures highlight the growing scale and complexity of digital threats facing organisations worldwide. Global attack volumes continued to rise, while reported ransomware victims increased by 87% compared with the same month last year.

Africa also recorded an average attack volume above the global figure, while phishing and generative AI data exposure added further challenges for security teams.

The findings underline the need for organisations to move beyond reactive security measures and strengthen prevention, monitoring, data protection and incident response across their digital environments.