# Ransomware Is Up Nearly 50%, and Small Businesses Are Taking Most of It

> NordLayer counted 2,894 ransomware attacks in Q3 2026, nearly 50% more than a year earlier, and about two in three victims had 200 staff or fewer. What to do about it.

Ransomware is usually reported as a big-company story: a hospital chain, an airline, a household brand. The numbers say otherwise.

NordLayer, which tracks more than 200 ransomware leak sites, counted 2,894 attacks between July and September 2026. That is nearly 50% more than the same quarter last year, 8.6% more than the quarter before, and the busiest three months in over a year. And about two in three of those victims had 200 employees or fewer.

If you run a business of that size, you are not too small to be worth it. You are the main market.

## What the Q3 2026 numbers show

| What NordLayer measured (Q3 2026)   | Result                                                     |
| ----------------------------------- | ---------------------------------------------------------- |
| Total attacks                       | 2,894, up from 1,933 in Q3 2025                            |
| Change from Q2 2026                 | Up 8.6%                                                    |
| Victims with 200 employees or fewer | About two in three                                         |
| Companies with 11 to 200 staff      | Nearly half of all attacks                                 |
| Top target country                  | United States, 805 attacks                                 |
| Most hit industries                 | Manufacturing (347), IT (210), professional services (153) |
| Fastest growing industry            | Healthcare, 150 attacks, up 30%                            |
| Most active groups                  | The Gentlemen (383), Qilin (363), INC Ransom (110)         |

A note on how this is counted. Every ransomware tracker, NordLayer included, counts victims that criminals name on their leak sites, because most victims never announce an attack. So the real figure is almost certainly higher, and the totals vary between trackers. They all agree on the direction.

## Why small businesses keep getting hit

Ransomware groups run like businesses, and a business picks customers it can close.

A company with 50 to 200 staff usually has real revenue, customer data worth something, and systems it cannot run without for a week. It rarely has a security team, a person watching alerts at night, or a tested plan for the day the screens go dark. NordLayer describes companies with five to fifty million dollars in revenue as the sweet spot: big enough to pay, small enough to break into.

Manufacturing tops the list for the same reason. A factory that cannot run its production schedule, or a supplier that cannot ship, loses money every hour, and that pressure is exactly what the ransom note is built to use.

## The shift that changes your defence: steal first, encrypt maybe

The classic ransomware attack locked your files and sold you the key. Good backups were the answer: restore and move on.

That answer is weaker now. NordLayer reports that more extortion groups skip encryption and simply steal data, then threaten to publish it. As one Nord Security expert put it, stealing data is faster and simpler, so one group can hit many victims at once with far less effort.

A backup gets your systems running again. It does nothing about your customer list, your contracts or your staff records appearing on a leak site. So backups are still essential, but the real defence moves earlier: keeping attackers out, and noticing quickly when they get in.

## Your suppliers are part of your attack surface

In October 2026, a new group called n0n listed more than 40 port authorities, maritime and shipping companies across 18 countries on its leak site. Security firm CyDome found that half of them are known customers of one maritime IT platform provider, whose website had been down for weeks. That provider has not confirmed it was the source, but the pattern is a familiar one: breach one supplier with access to many customers, and you get all of them.

Most small businesses have at least one of these: an IT support firm with remote access, a software vendor that can connect to your systems, an accountant or payroll provider with your logins. Each is a door you did not build and cannot fully see.

## Where ransomware actually gets in

The reassuring part of all this is that the entry points have barely changed. Attackers use the doors that are already open:

- **Remote access with a weak or stolen password.** VPNs, remote desktop and remote support tools exposed to the internet, protected by a password alone.
- **Internet-facing systems that are not patched.** Firewalls, VPN appliances, web servers and file transfer tools with known, exploited flaws. CISA adds new ones to its Known Exploited Vulnerabilities catalog almost every week. [PHP2Shell](/blog/php2shell-php-vulnerability), exploited this October before most servers were patched, is a typical example.
- **Phishing and tricked staff.** An email that drops malware, or a convincing message or call that gets someone to hand over a login, which is [how the ASOS breach began](/blog/asos-breach-social-engineering).
- **Suppliers.** A managed IT provider, software vendor or contractor whose access to you gets compromised. The same goes for the platforms your apps run on: this month [Railway, Zeabur and TiDB Cloud all disclosed breaches](/blog/hosting-platform-secrets-leak).

## What to do this month

None of this needs an enterprise budget. It needs someone to own it.

1. **Put phishing-resistant multi-factor authentication on every remote access route and every admin account.** Passkeys or security keys where possible. If remote desktop is open to the internet, close it and put it behind a VPN or a zero-trust access tool.
2. **Know what you expose to the internet, and patch it first.** Make a list of every system reachable from outside: firewall, VPN, website, email, file sharing, remote support. Those get patched within days of a critical fix, not at the next maintenance window.
3. **Make backups attackers cannot delete, and test them.** At least one copy offline or immutable, separate from your normal admin accounts. Do a full restore of one important system this month, and time it.
4. **Limit what one stolen login can reach.** Separate admin accounts from everyday ones, remove access people no longer need, and do not let one account touch everything.
5. **Review supplier access.** For each supplier that can connect to your systems: what can they reach, is it protected with MFA, and would you know if they logged in at 3 a.m.?
6. **Write a one-page incident plan.** Who to call, who decides, how to reach staff if email is down, where the backups are, and who talks to customers. Print it. Ransomware tends to take the shared drive with it.

The FBI and other law enforcement agencies advise against paying ransoms. Payment does not guarantee working decryption or deleted data, and it marks you as a business that pays. The best way to avoid that decision is to never be cornered into it.

## How this connects to the bigger picture

Ransomware is the most expensive version of a trend we keep writing about: attackers increasingly [log in with credentials that work](/blog/cloud-security-2026) rather than breaking in. If you are thinking about outsourcing detection, our post on [what agentic SOCs really do](/blog/agentic-soc-2026) separates the vendor claims from the evidence.

## Want to know how exposed you are?

The fastest way to find the doors ransomware uses is to try them. Our [VAPT service](/services/vapt) tests your internet-facing systems, web apps, APIs and cloud the way an attacker would, scores every finding with CVSS so you fix the worst first, retests for free once you have, and gives you a signed letter for clients and insurers. Our [security and compliance](/services/security-compliance) and [cloud infrastructure](/services/cloud-infrastructure) teams handle the follow-through: access reviews, logging, and backups you can actually restore from.

Tell us what your business runs on and [book a discovery call](/contact). We will tell you where you are most exposed, and what to fix first.

_Part of our guide to [AI security](/blog/ai-security)._

_Sources: [NordLayer's ransomware statistics](https://nordlayer.com/intelligence/ransomware-statistics/) (Q3 2026 figures), [Insurance Journal's report on NordLayer's Q3 findings](https://www.insurancejournal.com/news/national/2026/10/27/890350.htm) (27 October 2026), and the [Risky Business bulletin on the n0n maritime supply-chain attack](https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies/), citing CyDome. Verified against these sources on 27 October 2026._