Philippines records 10 claimed ransomware victims in August

By Francis Allan L. Angelo

Ten Philippine organizations were publicly named as ransomware victims in August, tying the country with China for fifth place in Asia-Pacific as global activity reached its highest monthly level so far in 2026, cybersecurity company Cyble reported.

The findings point to risks for business continuity and the people whose information companies hold, with attackers targeting industries where service interruptions or exposure of client data can intensify pressure to pay.

The figures track claims made by ransomware groups and should not be read as independently confirmed breaches or a complete count of incidents.

In a Sept. 28 release, Cyble Research and Intelligence Labs (CRIL), the research arm of the global AI-native cybersecurity company, cited 1,034 publicly claimed victims across 1,078 recorded attacks worldwide in its report, The Ransomware Brief.

That amounted to roughly 33 claimed victims a day, or more than one every hour.

Cyble attributed half of the 10 Philippine claims to Qilin, describing the Philippines as the only Southeast Asian country on the gang’s target list for the reporting period.

Attack counts rose 25% from 859 in July and 101% from 536 in June, according to the release.

The increase followed a three-month decline from March to June and a 60% rebound in July.

CRIL interpreted the resurgence as a new baseline rather than a seasonal spike, estimating that security planning based on first-half 2026 volumes now runs about 41% below actual activity.

Cyble’s report page lists 88 active gangs and 150 victims each in manufacturing and professional services, although other sections of the release give conflicting figures.

The release also recorded 126 victims in information technology and IT-enabled services and 98 in healthcare.

CRIL said these sectors face pressure from intolerable downtime or sensitive client information, noting that India’s IT services and manufacturing industries face those exposures.

Asia-Pacific recorded 143 victims, ranking third behind the Americas with 603 and Europe with 270.

India, Thailand, Taiwan, and Japan together accounted for 68 victims, nearly half the Asia-Pacific count, with Japan recording 11.

Australia and New Zealand, which Cyble tracked separately, recorded 22 victims.

The United States recorded 484 victims, nearly 10 times Italy’s 50, placing Italy second among the countries cited.

Asia-Pacific was the only region where Qilin did not lead, with The Gentlemen claiming 20 victims against Qilin’s 16.

Krybit and orova claimed 13 and 12 Asia-Pacific victims, respectively, exceeding Qilin’s regional total when combined despite neither appearing in the global top five.

Globally, the release said the five most active gangs accounted for 38% of activity.

Cyble’s report page puts Qilin’s count at 147, while the release lists 110 for The Gentlemen, together accounting for roughly a quarter of the 1,034 claimed victims.

CRIL attributed the surge to recruitment of affiliates and exploitation of internet-facing infrastructure rather than new encryption capabilities.

The researchers also cited extortion through data theft alone, including Cl0p’s PTC Windchill campaign, which used no encryption, and the use of artificial intelligence to accelerate intrusions.

“The quieter first half of the year was never a sign that ransomware was fading. Gangs were regrouping, and August shows what they regrouped into,” said Daksh Nakra, senior manager of research and intelligence at Cyble.

“For Indian organisations, the lesson is to stop planning against the names in the headlines. The groups most active in this region often have little global profile, and the defences that hold against them are the fundamentals: knowing what is exposed to the internet, who can reach it, and whether you can recover without paying.”