The record includes unconfirmed claims
Comparitech’s October 7 ransomware roundup recorded 2,627 incidents and claims for the third quarter of 2026, its highest quarterly total. Of those, 247 were confirmed and 2,380 remained unconfirmed. The distinction should travel with the headline whenever the figures reach a board presentation or an MSP’s customer briefing.
What the figures measure
In that report, confirmation requires an organization’s disclosure of ransomware or its acknowledgment of a cyberattack that coincides with a group’s claim. Unconfirmed claims may reflect false statements by criminals or incidents that organizations have not acknowledged publicly. Comparitech also warns that later disclosures can move incidents between reporting periods. The report records the largest quarterly percentage increase among its four principal sectors in education, at 50 percent. Healthcare rose 39 percent. Manufacturers accounted for 478 incidents and claims. These are observations within the researcher’s collection, rather than a measured probability that any individual organization will suffer an attack.
Use the trend to test a decision
The practical response is to ask which business dependency would be hardest to restore and whether the last exercise actually tested it. A school can prioritize access to student records and the systems needed to communicate with families. A healthcare provider can test how staff retrieve essential information during a disruption. A manufacturer can rehearse the handoff between recovering business applications and resuming a production schedule. An exercise is more useful when it includes the people who can authorize downtime, reach suppliers and approve a temporary working process. Restoring a sample file answers a smaller question than restoring the service that depends on it. Teams should record both results rather than describing either as complete recovery. Assign an owner to each unresolved dependency.
An evidence standard for customer reporting
MSPs should carry the source date, dataset definition and confirmation status into their own reporting. Comparing one tracker’s public claims with another tracker’s confirmed cases can create a misleading trend even when both researchers have done careful work. For a customer choosing its next security investment, the stronger discussion combines outside threat intelligence with local evidence: exposed assets, unresolved access exceptions and results from recovery exercises. A global count can justify asking harder questions. The customer’s answers should determine what gets fixed first.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
