R&DE activity hit a quarterly record in Q3 2026

At a glance

What this is: ZeroFox’s September and Q3 2026 threat-intelligence update shows ransomware and digital extortion activity easing month on month but setting a new quarterly record.

Why it matters: Security and identity teams need to treat extortion as a persistent operating condition, because sector concentration, regional spread, and attacker activity levels are all still changing quickly.

By the numbers:

• ZeroFox recorded at least 742 ransomware and digital extortion incidents in September 2026.
• Q3 2026 saw at least 2,381 ransomware and digital extortion incidents.
• North America accounted for approximately 47 percent of September 2026 incidents.
• Manufacturing remained the most targeted industry with at least 150 incidents in September 2026.

Context

Ransomware and digital extortion are now operating as a sustained pressure on business resilience, not as isolated criminal bursts. The core governance problem is that these campaigns exploit weak recovery readiness, exposed access paths, and operational tolerance for downtime across both human and non-human identity estates.

ZeroFox’s September 2026 data shows a market where volume can fall month on month while the broader trajectory still rises. That matters for IAM, PAM, and NHI governance because extortion actors often convert access weakness into interruption, data theft, and negotiation leverage before defenders can re-establish control.

Key questions

Q: What does a record quarter of ransomware and digital extortion mean for security teams?

A: A record quarter means extortion is still scaling even when month-to-month totals fluctuate. Security teams should treat this as evidence that attackers continue to find exploitable access, data, and downtime leverage. The practical response is to tighten privileged access, validate recovery pathways, and align response priorities to the systems that create the greatest business interruption.

Q: Why do manufacturing and healthcare remain top extortion targets?

A: Manufacturing and healthcare create unusually high pressure for attackers because operational interruption quickly becomes a business and safety problem. Manufacturing depends on uptime and often has fragile operational technology, while healthcare combines service continuity with sensitive data exposure. That makes these sectors especially vulnerable when access controls or incident recovery are weak.

Q: How can organisations tell whether extortion resilience is actually improving?

A: Look for evidence that attacker leverage is shrinking, not just that awareness is rising. Indicators include fewer standing privileges, faster credential revocation, better segmentation of critical services, and successful restore tests under disruption. If those controls are improving, extortion groups should have fewer paths to encryption, theft, or negotiation pressure.

Q: Who is accountable for reducing ransomware risk when email is the main delivery channel?

A: Accountability is shared, but security leadership owns the program design and control framework. IT and security teams must harden email filters, MFA, backups, and access controls. Managers should reinforce reporting expectations, and employees must follow the process when a message looks suspicious. Strong ransomware resilience depends on clear ownership across people, process, and technology.

Technical breakdown

Why extortion campaigns keep scaling despite monthly dips

Ransomware and digital extortion are opportunistic business models. Attackers do not need every campaign to succeed if enough victims pay or experience operational disruption, so short-term declines can sit alongside longer-term expansion. That makes month-on-month movement a poor standalone signal. The more useful question is whether the organisation’s exposure surface is shrinking through credential hygiene, privilege reduction, segmentation, and recovery testing. Where access paths remain broad and recovery assumptions remain optimistic, extortion groups can keep cycling through fresh targets faster than defenders can remove the conditions that make attacks profitable.

Practical implication: measure extortion readiness through access reduction and recovery resilience, not by assuming a quieter month means lower risk.

How regional and sector concentration changes the control problem

The report shows that North America still leads in incident count, but its share is falling while other regions grow faster. That pattern matters because it suggests attacker diversification rather than a single-market campaign. Sector concentration matters too: manufacturing’s low downtime tolerance and healthcare’s data and service dependency create distinct extortion leverage points. In identity terms, this often means different privilege paths are being abused in different environments, from operational technology-adjacent access to third-party and patient-facing portals. Control design therefore has to reflect where the business is most interruptible, not only where incident volume is highest.

Practical implication: align recovery, segmentation, and access control priorities to the business functions extortion actors can disrupt most cheaply.

What the quarterly record says about attacker cadence

A quarterly record usually matters more than a monthly dip because it reveals pace, not noise. When Q3 2026 exceeds prior highs, the implication is that extortion operators are sustaining throughput across multiple groups and campaigns rather than exhausting their target pool. That can point to better automation, broader affiliate capacity, or faster re-targeting after initial access. For defenders, this makes detection speed, privilege containment, and offboarding discipline more valuable than broad awareness efforts alone. If access can be reused across multiple systems or identities, extortion impact escalates long before the first alert is fully investigated.

Practical implication: reduce attack throughput by tightening privileged access reuse and validating response speed against realistic extortion timelines.

Threat narrative

Attacker objective: The objective is to maximise leverage by combining service disruption with data theft or disclosure pressure until the victim pays or negotiates.

1. Entry typically begins with exposed credentials, phishing, or other access abuse that gives an extortion crew a foothold into a victim environment.
2. Escalation follows when attackers locate privileged accounts, reusable tokens, or high-value systems that let them broaden access and collect sensitive data.
3. Impact occurs when the group encrypts systems, threatens disclosure, or uses downtime pressure to force payment.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• 230M AWS environment compromise: 230M AWS environments compromised via exposed .env files with cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Extortion is now a governance problem, not only a malware problem. The report’s record quarterly volume shows that criminal crews are repeatedly finding enough leverage in access, downtime, and data exposure to keep operating at scale. That shifts the priority from perimeter thinking to the management of usable privileges, recoverability, and data exposure windows. Practitioners should treat extortion resilience as a board-level control outcome, not an incident-specific response.

Regional share shifts matter because they reveal where criminal pressure is moving. North America still absorbs the largest volume, but faster growth elsewhere means programme assumptions based on historical concentration are becoming less reliable. That is especially relevant for global IAM and NHI programmes that still separate controls by geography or business unit. The operating model has to assume attacker mobility across regions and systems, not static targeting.

Manufacturing and healthcare remain high-leverage sectors because interruption hurts quickly. The article’s sector data reflects a simple extortion economics problem: attackers target environments where downtime, safety impact, or service interruption create the strongest negotiation position. That makes identity governance in those sectors inseparable from resilience planning. If privileged access paths, third-party access, or machine credentials are weakly governed, the extortion playbook becomes easier to execute.

Attackers are exploiting the gap between access governance and recovery governance. Many organisations still certify access separately from validating whether that access can be abused for mass disruption. Extortion campaigns expose that assumption gap directly. For identity teams, the meaningful question is whether privileged access, service credentials, and recovery pathways are controlled as one operational risk surface.

R&DE acceleration is a signal of control fatigue. The sustained rise across the first three quarters of 2026 suggests defenders are not keeping pace with the rate at which criminals can acquire, use, and monetise access. That is a strong case for narrowing standing privilege, hardening third-party pathways, and testing whether incident containment can outpace extortion timelines.

What this signals

Extortion volume is now a resilience benchmark. When quarterly totals keep breaking records, the key programme question is not whether attacks will continue, but whether identity, recovery, and segmentation controls can break the attacker’s business model. Organisations that still measure readiness only by prevention coverage will miss the point: extortion succeeds when business interruption remains cheap to create.

Control owners should expect more pressure on privileged access governance. Extortion crews increasingly benefit from broad access, reusable credentials, and weak offboarding, which means IAM and PAM programmes need to be assessed as operational resilience controls as much as security controls. The teams that can prove access reduction and rapid containment will be better positioned when the next wave lands.

For practitioners

• Restrict standing privilege in high-value systems Review administrative and service access in manufacturing, healthcare, and other high-leverage environments. Reduce persistent privilege paths that let attackers move from initial access to encryption or data theft.
• Reassess recovery assumptions against extortion pressure Test whether backup, restore, and containment processes still hold when business operations are interrupted, identity systems are unavailable, or multiple assets are encrypted at once.
• Harden third-party and cloud access paths Audit externally exposed credentials, tokens, and vendor-connected accounts that could be used as entry points for extortion campaigns. Remove access that is no longer needed and validate offboarding.
• Map critical business services to likely extortion targets Identify the systems whose outage would create the strongest negotiation leverage, then verify that logging, segmentation, and response ownership are in place for those assets.

Key takeaways

• Ransomware and digital extortion remain an active business threat even when monthly incident counts temporarily decline.
• The record quarterly total shows that attacker throughput is still rising across regions and sectors.
• Reducing standing privilege, validating recovery, and tightening third-party access are the controls most likely to change the outcome.

Key terms

• Extortion And Ransomware: Extortion and ransomware are attack patterns that pressure an organisation by encrypting data, stealing information, or threatening disruption until payment is made. For manufacturers, the impact is amplified by uptime pressure, because production delays, plant stoppages, and recovery costs can quickly exceed the ransom demand itself.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Recoverability: Recoverability is the degree to which a system can be brought back to a known-good, operational state after failure. In identity environments, it depends on configuration completeness, restore order, and behaviour validation, because access only exists if the restored system can actually enforce it.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to resilience outcomes across modern security programmes.