Waterfall Threat Report 2026: Ransomware Attacks on Critical Infrastructure Down 25% but Nation-State Threats Increasing

The Waterfall Security Threat Report 2026 finds that publicly documented ransomware incidents with physical consequences in critical infrastructure fell 25% to 57 events in 2025, driven partly by law enforcement pressure on enabling infrastructure. However, the report warns the decline may be temporary, with ransomware expected to resume increasing in 2026–2027 absent new countermeasures. Nation-state actors are increasingly targeting European energy and industrial systems, and the report highlights a near-miss involving Polish distributed generation linked to Russian activity.