The landscape of cyber extortion has entered a volatile new era in 2026, characterized by high-stakes "double extortion" and the rise of a "ransomware cartel." In 2025 alone, global ransomware victim counts reached 8,159—a surge of over 2,000 cases from the previous year. While some legacy giants have been disrupted, aggressive new players like have taken the lead, demanding tens of millions in cryptocurrency. The Most Prolific Threats (2025–2026)
: Hit Synnovis , a pathology provider, disrupting major NHS hospitals and demanding $50 million .
Modern groups have shifted away from simple encryption to "triple extortion," adding DDoS attacks and direct harassment of a victim's clients to maximize pressure. The Most Malicious Ransomwares Demanding Crypto...
: This group has extorted an estimated $244 million since its rise, aggressively targeting healthcare and transportation sectors.
The financial impact of these strikes has reached unprecedented levels, with some single events costing billions in operational damages beyond the crypto ransom. Victim Organization Attacking Group Financial Impact / Ransom ALPHV / BlackCat $2.87 billion in total damages Jaguar Land Rover Scattered Lapsus$ Hunters $2.5 billion economic damage (£1.9B) CDK Global $25 million paid in Bitcoin Cencora Dark Angels $75 million paid in Bitcoin Marks & Spencer Scattered Spider / DragonForce £300 million lost operating profit Emerging 2026 Trends Crypto Ransomware: 2026 Crypto Crime Report - Chainalysis The landscape of cyber extortion has entered a
: Known for "zero-day" mass exploitation of file transfer software (like MOVEit), Cl0p often foregoes encryption entirely to focus on pure data theft and extortion. High-Value Attacks and Losses
: In April 2026, it claimed responsibility for attacks on Bladex (a U.S. bank) and D. Heinrichs Logistic in Germany. Modern groups have shifted away from simple encryption
: Extorted pharmaceutical giant Cencora for $75 million in Bitcoin after an initial demand of $150 million.