Ransomware victim counts surge in July, but inflated claims may distort the picture
NCC Group's July threat report recorded 894 victim organization listings, a 22% jump from June, marking a year-to-date high. The industrial sector absorbed nearly a third of attacks, with the US accounting for 41% of incidents. While new groups like The Gentlemen and agentic AI attacks contributed, researchers suspect cybercriminal bravado may be inflating the numbers.
NCC Group's July threat report logged 894 victim organization listings, the highest monthly total this year, with a 22% rise over June. The industrial sector absorbed roughly one-third of attacks, while US organizations accounted for 41% of incidents. Ten groups were tied to most activity, led by The Gentlemen with 138 claims, followed by Quilin and Deadlock.
Researchers caution that figures may be inflated by newcomer CRPxO, which claimed 36 victims shortly after launching a low-cost RaaS operation with a $333 entry fee and 70% affiliate payout. Without released datasets or victim confirmations, NCC Group found the evidence inconsistent, suggesting cybercriminal bravado could be distorting the true threat landscape.
Inflated ransomware claims could mislead organizations into misallocating security resources, focusing on groups that may pose less real risk while genuine threats evolve. The emergence of agentic AI attack chains may signal a future where automated extortion becomes more accessible, potentially widening the pool of victims beyond traditional targets. Businesses, especially in industrial and healthcare sectors, could face increased pressure to verify threat intelligence before responding, while smaller firms may struggle to distinguish credible warnings from cybercriminal posturing.