The number of ransomware attacks in the UK is rising fast, with two groups in particular identified as the main culprits.

New data from Cohesity has revealed that UK attacks are up 60% quarter-on-quarter and 42% year-on-year. And despite the rising numbers of hackers entering the market, just two hacking groups were behind nearly a third – 32% – of all UK attacks.

One of these is Qilin, a Russian-speaking ransomware group that’s believed to be behind the cyber attack on NHS medical services provider Synnovis. This led to the cancellation of thousands of elective procedures and outpatient appointments this summer.

Qilin was responsible for 19% of UK ransomware attacks during the last quarter, according to Cohesity, with data from Rapid7 Labs indicating that it made around $193 million between July 2025 and March 2026.

The Gentlemen, meanwhile, accounted for 13% of all UK attacks, despite only having emerged in July last year. Its victims are mainly found in industrial organizations, the IT sector, and some consumer spaces. Its activity is largely concentrated in Europe, with the UK and Germany among the most heavily targeted countries. Notable victims include Synergy France, UK Electronics, and Equity Life.

And if Mondays aren’t bad enough already, they’re the most common day for UK ransomware activity, with an average of 71 attacks, followed by 64 per day on Wednesdays.

The most targeted UK industries during the quarter were professional services, with 22 recorded ransomware attacks in Q3 2026, followed by manufacturing at 17 and technology at 13.

The use of AI is becoming increasingly common, with The Gentlemen using AI models in negotiations and data triage, and hacking group JadePuffer demonstrating that an agent can execute an entire intrusion chain without a human operator.

“The biggest change in ransomware is not simply that attacks are becoming more sophisticated. It’s that AI is making them easier to scale and harder to predict. Criminals can now use AI to speed up everything from finding valuable data to negotiating with victims, while increasingly automating parts of an attack,” said Julien Mousqueton, field CISO at Cohesity.

“For businesses, that means the old assumptions that ransomware attacks follow a linear pattern and require large skilled teams are no longer reliable. Organisations should be putting more focus on protecting identities and stopping attackers from moving through their systems, rather than relying on yet another layer of endpoint security.”

But while UK attacks are coming from two groups in particular, overall the number of ransomware groups continues to soar, indicating increasing fragmentation.

There were 109 active groups globally in the third quarter of this year, with 35 new hacking groups emerging, although the top five groups accounted for just over a third of all listings.

And, said Cohesity, geographic diversification is increasing. The US share of recorded ransomware attacks fell from 51% to 34% over the third quarter. Meanwhile, the number of European victims more than doubled, led by a rise in reported incidents in Germany, the UK and Italy.

Overall, global ransomware hit a record high this quarter, up 28% on the previous quarter and 86% year-on-year.

FOLLOW US ON SOCIAL MEDIA