91 Ransomware Attacks Disclosed in January 2026
The ransomware threat continues to intensify in 2026. According to BlackFog's monthly tracking data, 91 publicly disclosed ransomware attacks occurred in January 2026 alone, setting an aggressive pace for what analysts predict will be a record-breaking year. More critically, a fundamental shift in attacker methodology is underway: many ransomware groups are now skipping encryption entirely, opting for data-only extortion that renders traditional backup strategies ineffective.
January 2026 by the Numbers
| Metric | Value |
|---|---|
| Total Publicly Disclosed Attacks | 91 |
| Most Targeted Sector | Healthcare (27 incidents) |
| Second Most Targeted | Government (11 incidents) |
| Third Most Targeted | Manufacturing (10 incidents) |
| Countries Affected | 22+ |
| USA Share of Attacks | 58% |
| Data-Only Extortion (No Encryption) | ~40% of incidents |
Sector Breakdown
Healthcare Under Siege
Healthcare absorbed the heaviest impact with 27 disclosed incidents in January, representing nearly 30% of all attacks. Hospitals, clinics, insurance providers, and pharmaceutical companies were all affected.
Why Healthcare Remains the Top Target
- High-value data — Patient records contain PII, insurance details, and medical histories worth up to $1,000 per record on dark web markets
- Operational urgency — Hospitals cannot tolerate downtime, increasing pressure to pay
- Regulatory exposure — HIPAA breach notifications create legal and reputational leverage for attackers
- Legacy systems — Many healthcare organizations run outdated systems with known vulnerabilities
Full Sector Breakdown (January 2026)
| Sector | Incidents | % of Total |
|---|---|---|
| Healthcare | 27 | 29.7% |
| Government | 11 | 12.1% |
| Manufacturing | 10 | 11.0% |
| Education | 9 | 9.9% |
| Finance | 8 | 8.8% |
| Retail | 7 | 7.7% |
| Technology | 6 | 6.6% |
| Other | 13 | 14.3% |
The Shift to Data-Only Extortion
Why Groups Are Abandoning Encryption
A growing number of ransomware operators now exfiltrate data without deploying encryption payloads. This represents a strategic evolution in the ransomware business model:
| Traditional Ransomware | Data-Only Extortion |
|---|---|
| Encrypt files, demand payment for decryption | Steal data, threaten to publish or sell it |
| Detectable by EDR/AV during encryption | Lower detection profile during exfiltration |
| Backups can mitigate impact | Backups are irrelevant — data is already stolen |
| Requires deploying ransomware binary | No malware deployment after initial access |
| Victim can sometimes recover without paying | Victim has no recovery option for leaked data |
Implications for Defenders
- Backup strategies alone are no longer sufficient — Organizations must focus on preventing data exfiltration, not just ensuring recoverability
- Data Loss Prevention (DLP) becomes critical — Monitor for unusual outbound data transfers
- Network segmentation limits attacker access to sensitive data stores
- Encryption at rest reduces the value of stolen data if exfiltrated
Geographic Distribution
The United States accounts for 58% of disclosed attacks in January, consistent with historical trends. However, attacks are spreading globally across 22+ countries.
| Region | % of Attacks |
|---|---|
| United States | 58% |
| Europe (combined) | 22% |
| Canada | 5% |
| Asia-Pacific | 8% |
| Latin America | 4% |
| Other | 3% |
Evolving Tactics in 2026
EDR/AV Disabling Now Standard
Modern ransomware operators routinely disable or bypass endpoint detection and response (EDR) tools before executing their payloads. Techniques include:
- Bring Your Own Vulnerable Driver (BYOVD) — Load signed but vulnerable kernel drivers to kill security processes
- EDR unhooking — Remove API hooks placed by security agents
- Safe mode deployment — Reboot into Safe Mode where security agents do not load
- Credential theft — Steal admin credentials to uninstall EDR agents via management consoles
Cloud and SaaS Targeting
Attackers are increasingly targeting cloud workloads, SaaS platforms, and remote endpoints rather than on-premises infrastructure:
- Cloud storage exfiltration — Targeting AWS S3, Azure Blob, and Google Cloud Storage
- SaaS account takeover — Compromising admin credentials for Salesforce, ServiceNow, and other platforms
- Remote endpoint compromise — Targeting VPN and remote desktop gateways to reach distributed workforces
New Actors Beyond Russia
Recorded Future predicts that 2026 will be the first year where new ransomware actors emerging outside of Russia exceed those originating within it. Emerging ransomware ecosystems are developing in:
- Southeast Asia — Vietnam and the Philippines
- South America — Brazil and Argentina
- Africa — Nigeria and South Africa
- Middle East — Iran-linked groups pivoting from espionage to extortion
Trend Analysis
What the Data Tells Us
- Volume is accelerating — 91 attacks in January projects to 1,000+ for the year if the pace holds
- Healthcare is disproportionately affected — Nearly 1 in 3 attacks hits healthcare
- Encryption is becoming optional — Data-only extortion is faster, stealthier, and harder to recover from
- The threat is globalizing — New actor ecosystems are emerging outside traditional Russian-speaking groups
- Defensive tools are being targeted — EDR/AV disabling is now a standard part of the attack playbook
Recommendations
For All Organizations
- Prioritize data exfiltration detection over encryption prevention — Deploy DLP and monitor for anomalous outbound transfers
- Harden EDR deployments — Enable tamper protection, use kernel-level protections, and monitor for BYOVD activity
- Segment networks aggressively — Limit lateral movement and access to sensitive data stores
- Implement phishing-resistant MFA — Hardware security keys for all privileged accounts
- Conduct ransomware tabletop exercises — Test response procedures for data-only extortion scenarios
For Healthcare Organizations
- Encrypt patient data at rest to reduce the impact of exfiltration
- Segment clinical systems from administrative networks
- Maintain offline copies of critical patient records for continuity during incidents
- Engage with Health-ISAC for sector-specific threat intelligence
Sources
- BlackFog — Ransomware Tracker January 2026
- Recorded Future — 2026 Ransomware Landscape Forecast
- SharkStriker — Top Ransomware Attacks of 2026