Key Takeaways

• Global ransomware incidents rose 41 percent year-over-year in July, with 487 reported attacks.
• North America accounted for 56 percent of all cases, followed by Europe at 24 percent.
• Services, healthcare, and manufacturing sectors saw significant disruption.
• Overall cyberattacks increased 5 percent, averaging 1,947 per organization per week.
• Education was the most targeted sector, followed by government and healthcare.
• Africa experienced the highest per-organization attack rate, while agriculture saw the fastest growth in attacks.

A new report from Check Point Research shows that ransomware activity surged globally in July, with 487 recorded incidents—an increase of 41 percent compared to the same month last year. According to BetaNews, North America experienced more than half of these attacks, accounting for 56 percent, while Europe represented 24 percent.

Lotem Finkelstein, director of threat intelligence and research at Check Point Software Technologies, noted that groups such as Qilin are expanding their focus toward high-value targets across multiple sectors. He said that July’s numbers reinforce that ransomware is both persistent and rapidly evolving, and argued that prevention-first strategies supported by AI are essential for staying ahead of threats.

The July spike in ransomware was part of a broader rise in cybercrime. On average, organizations worldwide faced 1,947 attempted cyberattacks per week during the month, representing a 5 percent increase from last year. The education sector was the most heavily targeted, with 4,210 weekly attacks per organization—up 24 percent year-over-year. Government agencies followed with 2,577 weekly attacks, and healthcare organizations averaged 2,538. Agriculture, while a smaller target overall, saw the fastest growth in threats, with incidents climbing 115 percent in a year.

Regionally, Check Point’s data shows that Africa faced the highest attack volume per organization, averaging 3,374 weekly attempts. Asia-Pacific followed with 2,809, and Latin America with 2,783. North America, despite not topping the per-organization list, recorded the largest year-over-year increase at 9 percent.

Ransomware-as-a-service operations continue to fuel the threat landscape. The Qilin group was linked to 17 percent of known ransomware incidents in July. Akira, a group targeting both Windows and Linux systems through symmetric encryption, accounted for 9 percent, while Play represented 6 percent. The prominence of these groups demonstrates how criminal organizations are diversifying attack strategies and exploiting gaps in cybersecurity defenses.

The report underscores that ransomware remains one of the most disruptive cyber threats worldwide. While targeted sectors may vary, the consistent year-over-year growth in incidents highlights the need for coordinated defense strategies, greater investment in security infrastructure, and stronger cross-sector information sharing to limit the operational and financial damage from these attacks.