Group-IB's August 2026 APAC Ransomware Data: What 190 Incidents Actually Tell You

Group-IB published ransomware tracking for the Asia-Pacific region covering August 2026. The recorded total was 190 incidents, a 26.7 percent increase month over month. The country distribution is instructive: India led with 32 incidents, Australia followed with 24, and Taiwan placed third with 20. Manufacturing was the most targeted sector with 38 incidents, and a single group, The Gentlemen, accounted for 37 of the incidents in the period.

Reading the numbers honestly

Public ransomware counts measure one thing well and several things poorly. They measure claims, because they are built largely from leak-site monitoring. They do not measure the true incident rate, because many victims never appear on a leak site and many claims are exaggerated or duplicated.
That caveat does not make the data useless. It makes it a signal about attacker attention rather than a complete census. A month-over-month rise of 26.7 percent in recorded claims means more pressure on disclosed victims, and it means the groups producing those claims are active.

What the distribution suggests

The sector split matters more than the country split for most defenders. Manufacturing's lead is consistent with the pattern that has held for several quarters: production systems have availability requirements that make them hard to take offline, and operational technology boundaries are uneven. The concentration in a single group, 37 incidents from The Gentlemen, points to a disciplined operator running a repeatable playbook rather than a crowd of independent actors.

How to use this

Treat the report as a prioritization input, not a benchmark. If your organization sits in manufacturing, or in the countries at the top of the list, the relevant question is whether your identity controls, backup isolation and recovery testing would survive an operator running that playbook. Leak-site statistics will not answer that question. Your own tabletop exercise will.

References

• Group-IB ransomware activity report for the Asia-Pacific region, August 2026