Ransomware and extortion incidents rose 11% in August 2026

At a glance

What this is: NHI Mgmt Group's analysis, drawing on ZeroFox's research: ZeroFox's August 2026 threat intelligence shows ransomware and digital extortion rose sharply, with 863 incidents, manufacturing still the most targeted sector, and a broader regional spread than earlier in the year.

Why it matters: For IAM, PAM, and NHI teams, the key lesson is that extortion campaigns now pressure every layer of access governance, from privileged accounts and service credentials to recovery workflows and third-party access paths.

By the numbers:

• ZeroFox observed at least 863 separate ransomware and digital extortion incidents in August 2026.
• August 2026 marked an approximate 98 percent increase year over year from the 436 incidents recorded in 2025.
• North America accounted for roughly 46 percent of all August 2026 incidents, or at least 399 incidents.
• The manufacturing industry recorded at least 175 R&DE incidents in August 2026.

Context

Ransomware and digital extortion are operationally different from opportunistic malware because the attacker’s goal is to force a business decision under pressure, not just to disrupt systems. In practice, that makes access control, credential governance, backup integrity, and recovery sequencing part of the response surface rather than separate concerns.

ZeroFox’s August 2026 figures point to a threat market that is expanding in volume and diversifying geographically, while manufacturing remains a durable target because downtime tolerance is low and operational technology environments often complicate containment. That is a familiar pattern, but the scale is still widening faster than many organisations’ identity and resilience controls.

Key questions

Q: What breaks when ransomware actors reach backup and recovery credentials?

A: Recovery stops being a control and becomes part of the attacker’s leverage. If the same credentials can encrypt systems, disable backups, or alter restore settings, containment becomes slower and negotiation pressure rises. Organisations need separate administrative paths for backup, restore, and production change so compromise of one identity does not collapse recovery authority.

Q: Why do ransomware groups target suppliers instead of the primary organisation in sensitive manufacturing ecosystems?

A: Suppliers often have weaker defences, less monitoring, and broad access to valuable data, so they can be easier entry points than the primary organisation. Once inside, attackers can steal documents, threaten disclosure, and pressure the larger target. The pattern is especially dangerous when the supplier handles engineering, production, or other trusted operational work.

Q: How can organisations tell whether extortion resilience is actually improving?

A: Look for evidence that attacker leverage is shrinking, not just that awareness is rising. Indicators include fewer standing privileges, faster credential revocation, better segmentation of critical services, and successful restore tests under disruption. If those controls are improving, extortion groups should have fewer paths to encryption, theft, or negotiation pressure.

Q: How do organisations know if identity governance is actually reducing ransomware exposure?

A: The strongest indicator is not how many policies exist but how quickly teams can identify, certify, and revoke high-risk access across employees, partners, and non-human identities. If access reviews still take weeks and orphaned accounts remain active, the programme has visibility but not control. Effective governance shrinks reachable systems before an attack begins.

Technical breakdown

Why extortion crews target access and recovery paths first

Ransomware and extortion operators usually do not need to destroy everything to create leverage. They focus on credentials, remote access, backup systems, and high-trust administrative paths because those assets let them disable recovery, move laterally, and increase the business cost of response. In an identity-heavy environment, that means the most valuable targets are often not the loudest endpoints but the accounts and tokens that can change security state, manipulate backups, or reach multiple environments. Once those are under attacker control, extortion becomes a governance problem as much as a malware problem.

Practical implication: Treat privileged access and backup administration as shared extortion risk domains, not separate operational teams.

Why manufacturing keeps appearing at the top of extortion reporting

Manufacturing remains attractive because disruption has immediate operational cost. Production stoppage, supply chain knock-on effects, and the difficulty of safely isolating operational technology give attackers strong leverage. Many manufacturing environments also have a mixed estate of legacy systems, shared accounts, and remote vendor access, which increases the number of paths an adversary can exploit. The result is not simply more malware in factories. It is a sector where the business consequences of access compromise are unusually high, so attackers concentrate where pressure will be felt fastest.

Practical implication: Prioritise identity segmentation, remote access control, and recovery validation around production-critical systems.

How extortion campaigns turn identity weaknesses into negotiation leverage

Extortion groups often convert weak identity governance into operational paralysis. Stolen credentials, poor offboarding, overprivileged accounts, and weak recovery separation allow attackers to reach data, disrupt services, or threaten publication after encryption. The same logic applies to NHI estates: service accounts, API keys, and automation tokens can become silent footholds if they are not inventoried, scoped, and revoked quickly. In other words, ransomware resilience now depends partly on whether the organisation can distinguish routine machine access from privilege that can be abused under pressure. See the Ransomware Playbook Template.

Practical implication: Map service accounts and secrets into your extortion recovery model so compromise does not outlive containment.

Threat narrative

Attacker objective: The attacker seeks to maximise business pressure by combining disruption, data leverage, and recovery suppression so the victim has fewer options than paying or negotiating.

1. Entry typically begins with stolen or abused access that gives the actor a foothold in the victim environment, rather than with a single noisy exploit.
2. Credentialed access is then used to move into administrative or backup-sensitive systems, where the attacker can disable recovery options and widen leverage.
3. Impact occurs when encryption, data theft, or service disruption creates enough operational pressure to force negotiation or public exposure.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• 230M AWS environment compromise: 230M AWS environments compromised via exposed .env files with cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Extortion is now an identity governance problem, not just a malware problem. The August volume increase matters because ransomware groups succeed when they can reach the accounts that control backups, remote access, and cross-environment administration. That turns access review, offboarding, and privilege scoping into resilience controls, not administrative hygiene. Organisations that still separate cyber recovery from identity governance are leaving the most valuable attack paths outside the recovery model.

Manufacturing’s persistent exposure shows that downtime tolerance drives attacker selection. The sector’s operational constraints make it easier for extortion crews to demand fast decisions, which means containment speed and identity segmentation matter more than theoretical hardening. This is exactly where ransomware playbook template thinking helps, because response must be planned around business interruption rather than only malware removal. Practitioners should assume production dependency will be exploited, not just exploited systems.

High-volume extortion campaigns expose the cost of standing privilege across human and non-human identities. When service accounts, vendor access, and administrator credentials remain permanently valid, attackers inherit durable leverage even after initial containment. The named risk here is standing access persistence, and it affects both human IAM and NHI governance. Teams should treat any persistent credential path as a potential extortion accelerator, especially where it can reach backups, orchestration tools, or cloud control planes.

The market signal is diversification, not decline. Even as North America’s share shifted downward, the absolute volume remained high and Europe continued to absorb more activity. That means organisations should stop treating extortion as a regional problem and start treating it as a control-plane problem: wherever privileged access, recovery privileges, and exposed credentials exist, extortion pressure can follow. Security programmes that can model that spread will be better placed to prioritise controls.

Recovery authority drift: extortion becomes harder to contain when the same accounts that administer systems can also alter backup, logging, or restoration settings. That failure mode sits at the junction of IAM, PAM, and resilience, and it is where many programmes still rely on informal trust. Practitioners should make recovery rights explicit, separately governed, and auditable before they are tested under attack.

What this signals

Extortion resilience now depends on control-plane separation. The practical lesson from August is that organisations cannot rely on endpoint response alone when attackers target identity, backup, and recovery paths at the same time. The governance question is whether your admin model still assumes a compromised credential can be trusted long enough to be useful.

Recovery design is becoming an access-design problem. If backup systems, remote vendor links, and production administrators share too much privilege, the attacker’s leverage survives containment. Teams should assume that extortion groups will look for the shortest path from stolen access to irreversible pressure, then design away that path before crisis conditions expose it.

For practitioners

• Harden backup and restore authority Separate backup administration from day-to-day system administration, then verify that restore paths require distinct approval and can be used even if primary admin accounts are compromised.
• Review privileged access around production systems Identify all accounts that can change production state, disable monitoring, or affect recovery, then remove standing access where those rights are not continuously required.
• Inventory service accounts and remote vendor access Map NHI and third-party credentials that can reach operational systems, then rotate or revoke anything that is not tied to a current business need.
• Test containment against extortion scenarios Run exercises that assume encryption, data theft, and backup interference happen together so the team can practice the order of containment, validation, and recovery.

Key takeaways

• The core risk is not just encryption or data theft, but the attacker’s ability to turn privileged access and recovery dependencies into negotiation leverage.
• ZeroFox’s August figures show a sharp rise in extortion activity, with 863 incidents and manufacturing still the most targeted sector.
• The most effective control theme is separation of authority, especially where backup, restore, and production administration currently overlap.

Related NHI Mgmt Group resources: Ransomware Playbook Template · Digital Forensics (DFIR) Guide

Key terms

• Extortion And Ransomware: Extortion and ransomware are attack patterns that pressure an organisation by encrypting data, stealing information, or threatening disruption until payment is made. For manufacturers, the impact is amplified by uptime pressure, because production delays, plant stoppages, and recovery costs can quickly exceed the ransom demand itself.
• Recovery Authority: Recovery authority is the approved ability to restore services, approve failover, or override normal controls during disruption. It is a governance question as much as a technical one, because recovery can stall when no one knows who may act or under what conditions.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners align identity controls with resilience, recovery, and access governance across the programme.