August ransomware surge: what practitioners need to act on

TL;DR: At least 863 separate ransomware and digital extortion incidents were observed in August 2026, up about 11% from July and roughly 98% year over year, according to ZeroFox, with manufacturing still the most targeted sector and North America’s share declining as activity diversified geographically. The pattern shows extortion pressure is broadening faster than many governance and recovery programmes can absorb.

Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “August 2026 Ransomware Wrap-Up”.

By the numbers:

• ZeroFox observed at least 863 separate ransomware and digital extortion incidents in August 2026.
• August 2026 marked an approximate 98 percent increase year over year from the 436 incidents recorded in 2025.
• North America accounted for roughly 46 percent of all August 2026 incidents, or at least 399 incidents.

Key questions

Q: What breaks when ransomware actors reach backup and recovery credentials?

A: Recovery stops being a control and becomes part of the attacker’s leverage.

Q: Why do ransomware groups target suppliers instead of the primary organisation in sensitive manufacturing ecosystems?

A: Suppliers often have weaker defences, less monitoring, and broad access to valuable data, so they can be easier entry points than the primary organisation.

Q: How can organisations tell whether extortion resilience is actually improving?

A: Look for evidence that attacker leverage is shrinking, not just that awareness is rising.

Practitioner guidance

• Harden backup and restore authority Separate backup administration from day-to-day system administration, then verify that restore paths require distinct approval and can be used even if primary admin accounts are compromised.
• Review privileged access around production systems Identify all accounts that can change production state, disable monitoring, or affect recovery, then remove standing access where those rights are not continuously required.
• Inventory service accounts and remote vendor access Map NHI and third-party credentials that can reach operational systems, then rotate or revoke anything that is not tied to a current business need.

Bottom line: The core risk is not just encryption or data theft, but the attacker’s ability to turn privileged access and recovery dependencies into negotiation leverage.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →