Check Point: Weekly Cyber Attacks Per Organization Up 48% in September
Organizations faced an average of 2,803 cyber attacks per week in September 2026, up 16% from August and 48% from a year earlier, according to Check Point's monthly threat landscape report. The company also reports higher phishing rates, risky GenAI prompts and ransomware activity well above last year's level.
- Organizations averaged 2,803 weekly cyber attacks in September 2026, up 16% month over month and 48% year over year, per Check Point.
- Education was the most targeted sector at 6,656 weekly attacks per organization; Europe saw the sharpest regional rise at 61%.
- 1 in 39 enterprise GenAI prompts posed a high risk of sensitive data leakage, affecting 89% of organizations that regularly use GenAI tools.
- 1 in 91 emails was classified as phishing, up from 1 in 112 in August.
- 824 ransomware attacks were reported, 53% more than in September 2025, led by The Gentlemen at 13%.
Attacks climb across sectors and regions
Check Point says weekly attacks per organization rose from 2,055 in May to 2,803 in September, an increase of 36% over five months. The company argues this points to sustained growth rather than an isolated monthly spike.
Education remained the most targeted industry, averaging 6,656 weekly attacks per organization, up 59% year over year. Attacks on the sector rose 24% from August, which Check Point links to the start of the academic year. Telecommunications ranked second with 3,483 weekly attacks per organization (up 29%), followed by Government with 3,443 (up 37%).
By region, Latin America had the highest volume at 3,813 weekly attacks per organization, up 35% year over year. Africa followed with 3,701 and APAC with 3,593. Europe recorded the fastest growth at 61% compared with September 2025, and North America rose 50%.
GenAI prompts expose sensitive data
According to Check Point, 1 in every 39 enterprise GenAI prompts posed a high risk of sensitive data leakage in September. This affected 89% of organizations that regularly use GenAI tools. A further 14% of prompts contained potentially sensitive information. The average user generated 131 prompts during the month, and each organization used an average of eight tools.
Latin America had the highest regional rate of high-risk prompts at 1 in 25, against a global average of 2.5%. North America followed at 1 in 37, APAC at 1 in 48 and Europe at 1 in 57. Among industries, Business Services had the highest rate at 4.9% (1 in 20 prompts), ahead of Financial Services at 4.1% and Healthcare & Medical at 3.5%.
The most common sensitive-data category was Network and IT Infrastructure, seen in prompts at 71% of organizations. Financial Data followed at 70%, Legal and Regulatory data at 68%, Employee and HR data at 62% and personally identifiable information at 60%. Check Point notes these figures show the share of organizations where each category was observed, not the share of prompts.
Phishing and ransomware
One in every 91 emails, or 1.1%, was classified as phishing in September, up from 1 in 112, or 0.89%, in August. Of those phishing emails, 81% contained links and 11% contained attachments. North America had the highest regional rate at 1 in 79 emails. Associations & Nonprofits had the highest industry rate at 2.17%, twice the global average, followed by Construction & Engineering at 2.05%.
Check Point counted 824 ransomware attacks in September, 53% more than in September 2025. The data comes from the public shame sites of double-extortion groups, which Check Point says have inherent biases. Business Services accounted for 31.3% of reported victims, Consumer Goods & Services for 15.2% and Industrial Manufacturing for 11.0%. North America made up 46% of incidents, Europe 25% and APAC 17%. The United States accounted for 41.9% of victims.
The Gentlemen was the most prevalent group with 13% of published attacks, followed by Qilin at 9% and Akira at 5%. Another 80 extortion groups also reported attacks. Check Point describes The Gentlemen as a fast-growing Ransomware-as-a-Service operation founded in mid-2025 that also acts as an Initial Access Broker.
What it means for organizations
Check Point concludes that cyber risk is growing in both volume and breadth, and that organizations should focus on reducing exposure before it becomes business impact. The company promotes a prevention-first approach combining AI-powered protection, shared intelligence and consistent governance across networks, cloud, workspaces and AI systems.
For security teams, the report highlights two practical points: the heavy reliance on links in phishing emails makes URL checking important, and rising prompt volumes across a broader set of tools make it more important to understand what employees share with GenAI services and which controls apply. The figures are Check Point's own and reflect its telemetry and ransomware leak-site tracking.
