ActiveThis topic is developing steadily with relevant new reporting.
FollowGlobal ransomware incidents and cyber extortion timeline
Late-April reporting showed broader ransomware access paths and enterprise disclosures
Key takeaways
- Ransomware in 2026 still looks like a durable global extortion market rather than a threat category that shrank after earlier takedowns.
- Healthcare, utilities and political organizations all remain exposed, and the Synnovis and Medtronic reporting shows that disruption and data-theft pressure can outlast the initial intrusion.
- Current reporting points to multiple operating models at once, including leak-site coercion, affiliate botnets, enterprise data theft and mass exploitation of exposed software.
News outlets