Ransomware Q1 2026: volumes flat, fragmentation rising, data-theft extortion replacing encryption

Analysis by Emsisoft covering the ransomware landscape in Q1 2026. Incident volumes are broadly flat year-on-year — approximately 2,300 incidents recorded across two tracking platforms. Active groups increased to 70-89 depending on methodology. US concentration of victims rose sharply to 64.7% of global total. The dominant tactical evolution is a shift away from encryption towards data-theft-only extortion, reducing operational complexity for attackers.