A new report from Black Kite reveals that ransomware activity is accelerating sharply, with healthcare organizations facing mounting risk as the number of active threat groups surges past 146 worldwide.
The ransomware intelligence firm tracked 7,551 confirmed victims globally between April 2025 and March 2026, a 25% increase over the prior 12-month period. The acceleration was most pronounced in the second half of the study window: victim counts jumped 60% from October 2025 to March 2026 compared with the preceding six months, and March 2026 alone saw 861 organizations hit—nearly 28 per day.
For healthcare CISOs, the trends are especially concerning. Manufacturing was the most targeted sector, but healthcare has consistently ranked among the top industries hit by ransomware, with groups such as Qilin, INC, and The Gentlemen mounting repeated attacks on hospitals, clinics, and healthcare technology firms. The proliferation of new groups—146 now active, up from 127 in March—means a larger and more unpredictable threat landscape for the sector.
“This isn’t a problem we’ve contained,” said Ferhat Dikbiyik, chief research and intelligence officer at Black Kite. “It’s still a lucrative business, and the barrier to running one keeps getting lower.”
Black Kite attributed the growth to fragmentation of the ransomware ecosystem, the emergence of dozens of new groups, and an expansion of attacks on small and less defended organizations. Third-party and supply chain compromises also played a role, with attackers using single vendor breaches to chain into multiple victims. The report noted that 41% of organizations with a high ransomware susceptibility index score experienced an incident, and over 90% of victims showed a meaningful spike in their score just before being hit.
The report’s finding that no organization is too small for attackers—with significant activity in the $1M to $5M revenue band—carries particular weight for healthcare, where small clinics and rural hospitals often lack dedicated security teams. The full Black Kite ransomware report is available on the company’s website.
