While executives were busy asking whether AI agents might one day autonomously schedule a meeting about synergy, ransomware gangs spent July doing the unfashionable thing: stealing data, encrypting systems, and reminding everyone that the old casino is still open.

According to The Register, citing Comparitech, ransomware attacks rose nearly 20 percent in July, from 668 incidents in June to 799 incidents in July. Only 51 were confirmed by victims at publication time, but the total made July the second-busiest month of 2026 for ransomware activity, narrowly behind March’s 805.

🤚 The Open-Palm Extortion Recap

The sector breakdown is the sort of spreadsheet that should be printed on expensive linen and mailed to every board member who believes “AI transformation” is a security plan. Comparitech found July increases against finance companies, technology firms, pharmaceutical and medical billing organizations, and education. The reported jumps were 71 percent, 62 percent, 46 percent, and 44 percent, respectively.

Utilities, legal firms, and government agencies reportedly saw declines, including a 44 percent drop for utilities. This does not mean critical infrastructure has achieved enlightenment. It merely means ransomware crews appeared to prefer other buffets in July, while separate non-ransomware attacks against water systems dominated headlines with their own industrial-control-flavored anxiety.

The United States remained the largest target, with 322 of the 799 July attacks logged by Comparitech. Germany came second with 40. This is less an international leaderboard than a reminder that large digital economies are essentially glass houses with procurement departments.

👐 The Two-Handed Gangland Portfolio Review

The names attached to July’s ransomware surge are familiar and new in the way luxury brands are familiar and new: same cruelty, refreshed logo. Qilin, known for the 2024 attack on pathology provider Synnovis that disrupted UK health services, claimed 125 victims in July. The Gentlemen, a newer operation, claimed 135 victims. Together, the two groups accounted for nearly one third of the attacks in Comparitech’s July tally.

The ingress methods were not specified in the Comparitech numbers reported by The Register. But the boring suspects remain undefeated: stolen credentials, weak or missing multi-factor authentication, unpatched systems, exposed services, and backup strategies that turn out to be inspirational fiction during restoration week. Trend Micro has linked The Gentlemen’s methods to stolen credentials, while Qilin has previously claimed it used zero-day vulnerabilities in high-profile intrusions.

This is the part of cybersecurity where glamour goes to die. Everyone wants an AI threat-hunting platform with a tasteful dashboard and a name like Sentinel Nebula Platinum. Many organizations still need phishing-resistant MFA, disciplined patching, network segmentation, tested backups, and fewer admin accounts treated like family heirlooms.

🌿 The Gentle Awakening

The AI distraction matters because attention is a budget line. Security teams are being asked to evaluate model risk, agent permissions, prompt injection, data leakage, autonomous coding tools, and whatever the board read in an airport newsletter. Those are real issues. But ransomware gangs do not pause for architectural fashion. They are perfectly content to exploit the same old weaknesses while everyone else attends the future.

The strategic insult is that ransomware is not especially mysterious. It is operationalized impatience. Criminals look for credentials, vulnerable systems, remote access, weak monitoring, and backups that cannot survive first contact with an angry Monday. Then they apply pressure using data theft, downtime, regulatory anxiety, and public embarrassment — the four scented candles of modern extortion.

• 799 ransomware incidents were counted by Comparitech in July.
• 322 targeted the United States, far ahead of any other country in the reported tally.
• The Gentlemen and Qilin together claimed nearly 33 percent of July’s attacks.
• Finance, tech, medical billing/pharma, and education saw the sharpest reported increases.

👑 The Gold-Leaf Reckoning

The lesson is not to ignore AI risk. The lesson is to stop treating ordinary security hygiene as beneath the dignity of the machine-learning age. A company can write a twenty-page AI governance policy and still be ruined by a reused password, a forgotten VPN appliance, or backups that were last tested when the CFO still believed blockchain would fix invoices.

July’s ransomware spike is a slap delivered with the calm precision of a maître d’ removing an overconfident guest from the tasting room. The attackers do not need your organization to misunderstand neural networks. They only need it to misunderstand recovery time, identity controls, and the difference between “we have backups” and “we can restore the business before the ransom note becomes investor relations material.”

“Please continue discussing artificial general intelligence; the criminals have already achieved artificially guaranteed invoices.” — The Slap of Wisdom Department of Legacy Menace, standing beside the immutable backup that was not immutable