SECTION 02
Ransomware Volume:
Attacks Are Accelerating Across Europe
Faster Than the Totals Show: The Ransomware Threat Over the Period
The 2,066 incidents were split into 648 in the first half of 2025, 734 in the second half of 2025, and 684 in the first four months of 2026.
Total Ransomware Attacks
H1 2025
H2 2025
Jan-Apr 2026
Read as three totals, the most recent figure looks like a step down from the second half of 2025, which is misleading because comparing them directly measures the calendar, not the threat.
Adjusted for time variations, the most recent period shows the sharpest acceleration in activity. On a monthly basis, incidents rose from 108 per month in H1-2025 to 122 in H2-2025, and then spiked to 171 during the first four months of 2026. This represents a 39.8% growth rate, calculated by taking the net increase of 49 monthly incidents relative to the H2-2025 baseline of 122 incidents.
YoY Increase in Ransomware
The like-for-like comparison confirms that the 684 incidents from January to April 2026 are 55.1% higher than the 441 recorded in the same four months of 2025.
The shape underneath those figures is a recent step up rather than a gradual climb.
Concentrated at the Top, Tightening in 2026
Ransomware is not spread evenly across Europe. Of the 2,066 incidents recorded across 31 countries between January 2025 and April 2026, five countries account for 68.5% of the total. Germany leads with 370 incidents (17.9%), followed by the United Kingdom at 347 (16.8%), France at 255 (12.3%), Italy at 240 (11.6%) and Spain at 203 (9.8%). These “Big Five” are Europe's five largest economies, so their position at the top is expected.
Beyond them, the volume falls away quickly. The next-largest markets are Switzerland at 80, Turkey at 73, and Austria at 61, and the remaining countries thin out from there.
Qilin Dominates Europe, SafePay Targets Germany
Europe's ransomware map is shaped by two actors with opposite strategies: One that is everywhere, and one that is almost entirely Germany.
Qilin is the generalist. It recorded 372 incidents across 26 of the 31 countries in scope, more than double the 159 recorded by the next most active group, Akira. No single market accounts for more than 18.5% of its activity.
SafePay is the specialist. It recorded 80 incidents in Europe, and 56.7% of them landed in Germany. Where Qilin's footprint is continental, SafePay's is almost entirely national.
Germany is the one major market where this matters. Everywhere else, the leading actor is the same generalist running through every country's totals. Germany alone is shaped by a group dedicated to it.
The Increase in 2026 Deepened the Concentration
The 2026 acceleration did not spread the threat across more of Europe. It concentrated it further into the markets that were already the largest.
On a like-for-like basis, the Big Five's share of incidents rose from 68.7% in January to April 2025 to 71.2% in the same four months of 2026.
The large percentage jumps in smaller markets are worth highlighting, but have not produced any meaningful pattern.
Turkey rose 433% (6 to 32), Romania 333% (3 to 13), and Poland 217% (6 to 19).
The Big Five still hold the larger part of the increase:
- France added 56 incidents (47 to 103), up 119%, reflecting not only broader market growth but also actor-level acceleration. Qilin rose from 5 to 22 incidents and Gentlemen appeared with 16 incidents after no activity in the comparable 2025 period.
- Italy added 44 (48 to 92), up 92%.
- The United Kingdom added 35 (87 to 122), up 40%.
- Spain added 27 (35 to 62), up 77%.
- Germany added 22 (86 to 108), up 26%.
Together they account for 184 of the 243 additional incidents, about three-quarters of the whole increase.
With the 2026 increase, Turkey’s 73 incidents in total place it seventh overall in the full country ranking for the entire 16-month window, ahead of Austria (61) and just below Switzerland (80).
Next: Ransomware isn't hitting Europe evenly.
Five countries absorbed 68.5% of all incidents. See exactly where the threat is concentrating.