Ransomware Hits Record as GenAI Data Leakage Risk Rises
Ransomware attacks reached a reported record of 1,063 cases in October 2026, while high-risk enterprise GenAI prompts continued to rise, according to Check Point. Global weekly cyber attacks fell from September but remained 32% above October 2025 levels.
- October recorded 2,550 weekly cyber attacks per organization on average.
- Ransomware reached 1,063 reported attacks, up 35% year over year.
- One in 35 enterprise GenAI prompts posed a high risk of sensitive data leakage.
- Education remained the most targeted sector.
- The n0n group entered the ransomware top three within a month.
Cyber attacks remain well above last year
Organizations experienced an average of 2,550 cyber attacks per week in October, a 9% decrease from September and a 32% increase compared with October 2025. Check Point said the monthly decline does not indicate a change in the broader direction, with attack levels still roughly one third higher than a year earlier.
Education remained the most targeted sector, with an average of 5,934 weekly attacks per organization, up 33% year over year. Agriculture followed at 3,218 weekly attacks, after a 93% annual increase, while Telecommunications recorded 3,068, up 19%. Check Point said all 23 tracked sectors recorded double-digit growth from last year.
Africa had the highest regional volume, averaging 3,834 weekly attacks per organization, up 38% year over year. Latin America followed at 3,483 and APAC at 3,436. Europe recorded the sharpest increase, with attacks up 39% from October 2025, while North America rose 33%.
High-risk GenAI prompts expose sensitive information
One in every 35 enterprise GenAI prompts posed a high risk of sensitive data leakage in October, affecting 90% of organizations that regularly use GenAI tools. The high-risk rate rose from 2.3%, or 1 in 43 prompts, in August to 2.5%, or 1 in 39, in September, and 2.9%, or 1 in 35, in October.
Users generated an average of 91 prompts during the month, while each organization used an average of seven tools. Check Point also found that 12% of prompts contained potentially sensitive information. Financial data was observed at 71% of organizations, followed by legal and regulatory data and network and IT infrastructure data at 70% each. Employee and HR data appeared at 67% of organizations, while personally identifiable information appeared at 62%.
Business Services had the highest industry rate of high-risk prompts, at 5.4%, or 1 in every 19 prompts. Government followed at 4.6% and Financial Services at 4.5%.
Phishing eases as ransomware reaches a new high
Phishing became less frequent in October. One in every 128 emails, or 0.78%, was classified as phishing, down from 1 in 91, or 1.10%, in September. Links appeared in 79% of phishing emails, while 14% contained attachments. North America had the highest regional phishing rate at 1 in 123 emails, and Construction and Engineering recorded the highest industry rate at 1.72%, or 1 in 58 emails.
Ransomware activity moved in the opposite direction. Check Point reported 1,063 attacks in October, 35% more than in October 2025 and the highest number reported to date. Business Services accounted for 31.5% of reported victims, followed by Consumer Goods and Services at 14.9% and Industrial Manufacturing at 11.6%.
North America represented 48% of reported ransomware incidents, with Europe at 22% and APAC at 18%. The Gentlemen was the most prevalent group, responsible for 13% of published attacks, followed by Qilin at 12%. The n0n extortion group accounted for 8% and entered the top three one month after its first appearance, quadrupling its monthly share of published victims. Check Point said n0n relies heavily on AI-assisted tooling.
For organizations, the findings point to risks across networks, cloud systems, endpoints, email and AI services. Check Point’s prevention-first view calls for AI-powered security, consistent visibility and shared intelligence across the attack surface.
