Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors
Brief
The Americas carried the heaviest ransomware burden of any region on the planet in the first half of 2026. According to Cyble Research and Intelligence Labs (CRIL), North and South America combined experienced 2,188 documented ransomware attacks between January and June 2026.
That single figure — 2,188 attacks — represents more than 57% of the 3,836 ransomware incidents CRIL tracked worldwide , making the Americas the undisputed center of gravity for global ransomware operations.
But the Americas is not a single threat theatre — it is two. North America alone absorbed 1,981 attacks , driven by a mature, multi-group Ransomware-as-a-Service (RaaS) economy competing for market share. South America, by contrast, recorded 207 attacks concentrated around a much smaller set of operators, with one group — The Gentlemen — claiming nearly a quarter of all regional incidents outright.