BlackFog counted 95 publicly disclosed ransomware attacks worldwide in May 2026 across 17 countries, the United States taking 54 and Australia 18, so the monthly tempo held even as enforcement intensified1. The security vendor compiles its figures from leak-site postings and public disclosures, which capture the visible floor of activity rather than the full total.
Healthcare was the hardest-hit sector with 28 incidents, because care delivery cannot tolerate downtime, so hospitals pay faster and crews target them first2. Qilin led all crews with 11 claimed victims, but the more telling figure is the 37 active groups running in a single month with no sign of consolidation3.
That group count is why the takedown headlines do not translate into falling risk. When US prosecutors unsealed Scattered Spider charges against Peter Stokes in April, they took an individual actor off the board without thinning the ecosystem around him. The bottleneck on the criminal side is the supply of affiliates, the freelance operators who rent a crew's tooling and split the proceeds, and neither an arrest nor a server seizure reduces that pool. For a defender, the lesson is that enforcement wins should not be read as a drop in operational threat; the tempo is the planning baseline, not the takedown.
