R&DE incidents hit a record: what should security teams expect next?

TL;DR: At least 742 ransomware and digital extortion incidents were recorded in September 2026, according to ZeroFox, while Q3 reached a record 2,381 incidents and year-to-date totals nearly matched 2025’s full-year volume, indicating global extortion activity is still expanding despite a monthly dip. The operational lesson is that regional and sector concentration is shifting faster than many response programmes are tracking.

Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “September 2026 Ransomware Wrap-Up”.

By the numbers:

• ZeroFox recorded at least 742 ransomware and digital extortion incidents in September 2026.
• Q3 2026 saw at least 2,381 ransomware and digital extortion incidents.
• North America accounted for approximately 47 percent of September 2026 incidents.

Key questions

Q: What does a record quarter of ransomware and digital extortion mean for security teams?

A: A record quarter means extortion is still scaling even when month-to-month totals fluctuate.

Q: Why do manufacturing and healthcare remain top extortion targets?

A: Manufacturing and healthcare create unusually high pressure for attackers because operational interruption quickly becomes a business and safety problem.

Q: How can organisations tell whether extortion resilience is actually improving?

A: Look for evidence that attacker leverage is shrinking, not just that awareness is rising.

Practitioner guidance

• Restrict standing privilege in high-value systems Review administrative and service access in manufacturing, healthcare, and other high-leverage environments.
• Reassess recovery assumptions against extortion pressure Test whether backup, restore, and containment processes still hold when business operations are interrupted, identity systems are unavailable, or multiple assets are encrypted at once.
• Harden third-party and cloud access paths Audit externally exposed credentials, tokens, and vendor-connected accounts that could be used as entry points for extortion campaigns.

Bottom line: Ransomware and digital extortion remain an active business threat even when monthly incident counts temporarily decline.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →