Ransomware attacks Q3 2026: up 30% in claims, 9% confirmed

The quarter's ransomware numbers look like a surge, and the research firm that produced the biggest one says it isn't. Also today: a robot-soldier startup that missed payroll, and the Pentagon contract it never actually won.

The ransomware "boom" of 2026 is mostly a boom in claims — and the firm that published the 30% figure says so itself, in the same report. Three independent trackers counted somewhere between 2,600 and 2,930 claimed victims in the third quarter. Every one of them measured a double-digit rise. Only one of them bothered to check whether the victims agreed they had been attacked.

Start with the counts. Halcyon logged 2,766 claimed victims in Q3, up 39.1% on Q2, spread across 111 groups in 122 countries, including more than 1,000 claims in August alone — its highest monthly total on record, per its Q3 ransomware report. ReliaQuest puts the quarter at roughly 2,928 claims against 2,252 in Q2, a 30% rise. Comparitech counted 2,627, up 29% from 2,030 and 61% year over year. The spread between them is normal: each counts a different slice of leak sites and de-duplicates differently.

Then read the sentence that ought to travel with all of those figures. In the same report that supplies the 30%, ReliaQuest writes that the rise "is unlikely to reflect a real increase in ransomware activity," according to its Q3 threat spotlight. Its arithmetic is blunt: 43 first-time groups accounted for 93% of the quarter's increase, while crews that operated in both Q2 and Q3 added just 1%. Several of the new names carry the fingerprints of rebranding, recycled victim data, or claims that evaporate on inspection — it names ExfilSquad as a scraper dressing up whatever access it had as a breach.

The baseline makes it worse. ReliaQuest's Q2 was itself down 15% from Q1, so Q3's roughly 2,928 claims sit only about 10% above where the year started. A summer spike that recovers a spring dip is a fluctuation, not a new plateau — and the "nearly 3,000 attacks" line that circulated this week is a count of announcements, not of intrusions.

Comparitech supplies the number that should anchor the conversation instead: only 247 of its 2,627 claimed victims — 9.4% — were confirmed by the victim itself. Nine in ten of the attacks that get counted may not have happened the way they were described.

So where is the AI in all this? Not where the headline says. Wired's Kernel Panic newsletter framed the quarter as an AI-fueled boom, and its two most quoted researchers are more careful than that framing. Halcyon's Cynthia Kaiser, a former FBI cyber deputy director, told Wired the United States was comparatively steady while international attacks rose sharply, and that she does think the increase is "in part fueled by AI." Recorded Future's Allan Liska put the same point in operational terms: LLMs show up in better phishing lures and in the negotiation calls, but "the 'successful' ransomware groups are still largely human operated." He added a detail that cuts against the boom story entirely — attacks this year already dwarf 2025's total, but the number involving actual encryption may fall, as crews shift to pure data extortion because it needs less tooling.

The harder AI evidence is buried in Halcyon's report rather than in the interviews. It documents AI agents harvesting more than 2,100 Azure AD token sets across 40-plus tenants in roughly 34 hours, and it cites what researchers assessed as the first end-to-end agentic ransomware, disclosed in July. It also logs the ceiling: of 405 AI-linked malware samples Halcyon tracked, only 12 reached a protected endpoint — and all 12 were detected.

Those two numbers describe the same quarter, and together they are the honest read. AI is lowering the cost of entry, which is exactly why 43 new crews can appear in three months and immediately claim thousands of victims; it is not yet producing attacks that work. Fragmentation is real. Volume is inflated. Capability is improving from a low base, and the detection record on the samples that matter is still 12 for 12.

The practical consequence: a security budget justified by leak-site counts is being sized against marketing. The numbers worth tracking are confirmed incidents, insurance claims and the small set of agentic intrusions that actually reached a host. The vendors selling against fear have an obvious incentive not to lead with the 9.4%.

Foundation Future Industries, the Eric Trump-backed maker of military humanoid robots, missed its October 30 payroll and has not paid staff since, CNBC reported Saturday, citing people with direct knowledge of the company. It is the second cash crunch this year: payroll also came up short in August and was covered by a bridge loan from an existing investor. The detail that has staff angriest is older — CEO and co-founder Sankaet Pathak borrowed $4.6 million from the company in 2025 to buy a $4.6 million house in Sausalito, a transaction CNBC ties to public records naming an LLC he solely controls. The loan predates the payroll failure by a year and is not what emptied the account, but it is what makes the account look empty to the people not being paid.

Pathak is Foundation's sole board member and majority shareholder, a structure CNBC says has worried prospective investors, and he has been trying to raise hundreds of millions at a $3 billion valuation since at least January. The company's most-repeated credential deserves the same scrutiny. The widely reported $24 million in Pentagon contracts is not a contract Foundation won: Wired established in July that Foundation's own list consisted of two agreements inherited from its late-2024 acquisition of Boardwalk Robotics and three that arrived through a research institute, with no independently secured awards. Humanoids Daily later noted the Army's xTechHumanoid prize at Quantico went to the institute's robot, not Foundation's. Pathak's previous company, fintech middleman Synapse, collapsed in 2024 with more than 100,000 customers locked out of $265 million in deposits; a bankruptcy trustee said as much as $96 million was missing.

What AI there is, is asserted rather than published. Foundation markets "Cortex," a physics foundation model meant to give its Phantom robots data-efficient control, with no paper, no benchmarks and no third-party evaluation. CNET's hands-on with the MK-1 was a teleoperation demo — a human in a VR headset, the robot mirroring. Rodney Brooks told Wired that reliable operation in unfamiliar settings is a decade-plus problem. A one-person board, an unclosed round and a foundation model with no published evidence is a hard combination to price at $3 billion, whatever the robots look like in the next demo.

What to watch: whether Q4 claim counts fall as the rebranded crews get de-duplicated — and whether Foundation closes the round before its engineers close their laptops.

Would you size a security budget on claimed attacks or confirmed ones? Write to us via our contact page.