TicTac Cyber Security has updated its research on ransomware attacks across Europe and recorded 1,115 attacks in the first half of 2026, a 29% increase over the same period in 2025. April 2026 was the worst month ever recorded on the continent, with 245 attacks, and the year is on track to close with roughly 2,250 attacks. The research also finds that business services, including law firms and accounting practices, are on pace to overtake manufacturing as Europe's most targeted sector by the end of the year. The firm's earlier forecast for 2025 came within 98.7% of the final total.
ATHENS, Greece, Aug. 11, 2026 /PRNewswire-PRWeb/ -- TicTac Cyber Security, a Greek cybersecurity and data recovery firm and Acronis Platinum Partner, has released an update to its research into ransomware attacks across Europe, first published in 2025. The updated analysis recorded 1,115 attacks across the continent in the first half of 2026 alone, a 29% increase over the same period in 2025. April 2026 was the worst month ever recorded on the continent, with 245 attacks. If the current pace holds, 2026 is on track to close with approximately 2,250 attacks, which would make it the third consecutive record year.
The update tests the accuracy of TicTac's original 2025 study, which forecast that European ransomware attacks would exceed 1,746 by the end of that year. The year closed with 1,723 recorded attacks, putting the original forecast within 98.7% of the final figure.
Key Findings
- Attacks have climbed every year since tracking began: 847 in 2023, 1,335 in 2024, 1,723 in 2025, and 1,115 in the first six months of 2026 alone.
- Qilin is the most active ransomware group in Europe, responsible for 191 attacks, or 17.1% of the total, in the first half of 2026. TheGentlemen, a group that did not exist a year earlier, has already climbed to second place with 140 attacks, or 12.6%.
- LockBit has returned under a new name, LockBit 5.0, and is back inside the top five most active groups after nearly disappearing in 2025.
- Manufacturing narrowly remains Europe's most targeted sector at 17.04% of attacks, with business services close behind at 16.41%.
- Germany was the hardest-hit country with 229 attacks, followed by the United Kingdom with 202, France with 133, Italy with 126 and Spain with 98. The five largest economies account for roughly 70% of all recorded attacks.
Business Services Are Closing In on Manufacturing
The most significant shift in the 2026 data is a reversal that unfolded within a single quarter. In the first quarter of 2026, manufacturing led decisively, with 95 attacks against 46 for business services, a nearly two-to-one lead. In the second quarter that gap flipped entirely: business services, including law firms, accounting practices and consultancies, recorded 137 victims against 95 for manufacturing. Based on this trend, the research projects that business services will overtake manufacturing to become Europe's most targeted sector by the end of 2026, a first since tracking began in 2023.
Today's Leading Groups Were Unknown Three Years Ago
In 2023, a single group, LockBit3, was responsible for more than one in four ransomware attacks across Europe, at 26.74%. Within two years it had effectively disappeared from the leading actors, replaced by groups such as Qilin and TheGentlemen, both of which were either unknown or nonexistent at the time. Based on this same pattern of turnover, the research forecasts that at least two of today's top ten groups will themselves disappear or rebrand by mid-2027.
Methodology
The analysis covers ransomware activity across Europe from January 2023 through June 30, 2026. Data was collected through the official ransomware.live API and filtered to isolate incidents affecting European countries, then categorized by sector, ransomware group and country. Only publicly reported and confirmed incidents attributed to known ransomware groups are included, which means the findings represent the visible portion of ransomware activity and the true number of incidents is likely considerably higher.
About TicTac Cyber Security and Social Active
TicTac Cyber Security is a Greek cybersecurity and data recovery firm and an Acronis Platinum Partner. Since 1999 the company has handled thousands of data recovery and incident response cases, with services spanning penetration testing, security assessments, NIS2 compliance and incident response. The research was conducted by Social Active an award-winning B2B marketing and research agency on behalf of TicTac Cyber Security.
Read the full research here: https://tictac.gr/en/blog/ransomware-attacks-in-europe/
Media Contact
Andreas Kougentakos, SocialActive, 30 6972813399, [email protected], https://socialactive.com
SOURCE TicTac Cyber Security
Share this article