July’s cyber threat landscape was shaped by pressure across multiple fronts. Global cyber attacks continued to rise, ransomware activity broke from the more stable pattern seen earlier in the year, and GenAI exposure became a clearer operational risk as employees used more tools and generated more prompts across the enterprise.
The global attack curve continued upward in July. Organizations faced an average of 2,336 weekly cyber attacks, up 3% from June and 16% from July 2025. While the monthly rise was more moderate than June’s rebound, the broader trend remains clear: average weekly attacks per organization have increased by 13.7% since May, signaling sustained pressure rather than a temporary spike.
Education remained the most targeted sector, averaging 4,848 weekly attacks per organization, up 14% year over year. Government ranked second with 3,044 weekly attacks, up 11%, followed by Telecommunications at 2,927, up 6%. Energy and Utilities moved into fourth place with 2,759 weekly attacks, up 20%, while Hospitality, Travel and Recreation entered the top five with 2,614 attacks, up 28%, possibly reflecting higher exposure during the summer travel period.
Regionally, Latin America continued to face the highest attack volume, with 3,561 weekly attacks per organization on average, up 19% from July 2025. APAC followed with 3,316 weekly attacks, while Africa ranked third despite a 5% year-over-year decline. Europe stood out for its growth rate, with attacks up 18% year over year, while North America rose 9%.
GenAI risk is becoming a daily business issue. The main concern is not only how AI tools are used, but what employees enter into them, from customer records and internal documents to infrastructure, legal, financial, or HR information. July’s data shows how quickly that exposure can scale:
This makes GenAI both a governance and security issue, especially as adoption moves faster than policies, training, and controls. Exposure was highest in Latin America and North America, while Europe and APAC were slightly below the global average. By industry, Business Services and Healthcare and Medical recorded the highest risk, followed by Information Technology and Government.
The type of information being exposed is also important. Personal data remained the most common sensitive category, appearing in 70% of organizations. Financial Data and Network and IT Infrastructure followed at 68% each, while Legal and Regulatory content appeared in 63% and Employee and HR data in 62%. The issue is not limited to one team, use case, or document type. It cuts across the core information organizations rely on every day.
Despite growing focus on newer attack surfaces, email remained a high-volume risk channel in July. One in every 128 emails, or 0.78%, was classified as phishing, while another 20% fell into unwanted or risky categories such as graymail, spam, and suspicious messages, adding to the daily burden security teams need to filter and investigate.
Africa recorded the highest phishing rate, with one in every 106 emails classified as phishing, followed by North America at one in every 117. Beyond the regional differences, the trend reinforces email’s role as a common starting point for broader attack chains, from credential theft and malware delivery to business email compromise. In July, that escalation was most visible in ransomware activity.
* This ransomware data draws from ransomware “shame sites” operated by double-extortion groups, which publicly disclose victim information. While these sources have inherent biases, they provide valuable insight into the ransomware landscape.
The clearest shift in July came from ransomware. Reported attacks reached 964, up 87% from July 2025 and 49% from June. This marked a decisive break from the first half of 2026, when monthly ransomware activity averaged around 672 incidents.
The increase was broad, touching multiple regions and industries, but Business Services remained the most affected sector, accounting for almost one third of reported victims.
North America remained the most affected region, accounting for 45% of reported ransomware incidents. Europe followed at 28%, while APAC accounted for 17%.
At country level, the United States continued to dominate the victim count with 39.4% of reported attacks, followed by Germany, Canada, the United Kingdom, and Italy.
The Gentlemen and Qilin were the most prevalent ransomware groups in July, each responsible for 14% of published attacks. DeadLock climbed to the top three, with 10% and 97 reported victims.
July’s threat landscape was defined by accumulation rather than a single dominant risk. Global attacks kept rising, ransomware accelerated sharply, and GenAI exposure became more visible as part of routine business activity. For security teams, the message is clear: prevention cannot be limited to one layer or one threat category. Organizations need coordinated protection across network, cloud, endpoint, email, and AI usage, supported by the visibility to understand where sensitive data and attacker activity are moving next.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。