Cyber attacks rise 16% as ransomware surges in July

Organisations worldwide faced an average of 2,336 cyber attacks a week in July 2026, according to Check Point Research. That was 16% higher than a year earlier.

The cyber security group's latest monthly threat data also showed a sharp rise in ransomware activity, with reported victims reaching 964 during the month. That was up 49% from June and 87% from July 2025, a clear break from the steadier pattern seen in the first half of the year.

Attack levels rose across several major regions. Latin America remained the most targeted, with 3,561 weekly attacks per organisation, followed by Asia-Pacific on 3,316 and Africa on 3,237, though Africa's total was down 5% year on year.

Europe posted one of the fastest growth rates, climbing 18% year on year to 2,051 weekly attacks per organisation. North America recorded 1,613, up 9%.

Sector pressure

Education remained the most targeted industry, averaging 4,848 weekly attacks per organisation. Government followed on 3,044, with Telecommunications at 2,927.

Other sectors also saw increases. Energy and Utilities rose 20% to 2,759 weekly attacks per organisation, while Hospitality, Travel and Recreation entered the top five with 2,614 attacks, up 28%.

Ransomware followed a different pattern from the overall attack rankings. Business Services accounted for 32.5% of reported ransomware victims, followed by Industrial Manufacturing at 14.4% and Consumer Goods and Services at 13.4%.

North America remained the most affected region for ransomware, representing 45% of reported incidents. Europe accounted for 28%, while Asia-Pacific made up 17%.

At country level, the United States accounted for 39.4% of reported ransomware attacks. Germany, Canada, the United Kingdom and Italy followed.

Email and AI

The data also pointed to continued risk through email. One in every 128 emails, or 0.78%, was classified as phishing, while another 20% fell into unwanted or risky categories such as graymail, spam and suspicious messages.

Africa had the highest phishing rate, at one in every 106 emails. North America followed at one in every 117.

Generative AI use emerged as another area of concern in the month's findings. One in every 36 enterprise prompts carried a high risk of sensitive data leakage, while 88% of organisations with regular GenAI use were affected by high-risk prompt activity.

Some 22% of prompts contained potentially sensitive information. Organisations used an average of eight GenAI tools, and users generated 95 prompts on average.

Personal data was the most common type of sensitive information exposed, appearing in 70% of organisations measured in the report. Financial data and network and IT infrastructure each appeared in 68%.

Ransomware groups also shifted during the month. The Gentlemen and Qilin were the most prevalent in July, each linked to 14% of published attacks, while DeadLock ranked third with 10% and 97 reported victims.

Omer Dembinsky, Data Research Manager at Check Point Research, set out the company's view of the trend. "July's data shows that cyber risk is accumulating across multiple fronts at once," Dembinsky said. "Attack volumes continue to rise, ransomware has accelerated sharply, and GenAI exposure is now part of daily business activity. Organisations need prevention-first, AI-driven security that protects networks, users, data and AI workflows before attacks can cause impact."