Education stays at the top of attackers’ target list, risky GenAI use and ransomware keep growing, with a new extortion group making use of AI tooling to climb to top 3
Check Point Research, the threat intelligence arm of Check Point® Software Technologies Ltd., today published its latest Global Threat Intelligence findings, covering October 2026. During the month, the average organisation globally faced 2,550 cyber attacks every week, which is 9% fewer than in September but 32% more than in October 2025. In Australia, the average organisation faced 2,117 cyber attacks every week in October, which is 9% fewer than in September but 39% more than in October 2025. In New Zealand, the average organisation faced 1,913 attacks every week in October, which is 7% fewer than in September but 16 per cent more than in October 2025.
The picture is mixed: attack volumes and phishing both eased compared with the previous month, yet risky GenAI prompts kept rising, a record 1,063 ransomware attacks globally were publicly reported, and a new ransomware group broke into the top three with extensive use of AI tooling.
“A lower monthly figure should not be mistaken for a lower level of risk, as attacks are still running about a third above where they were a year ago,” said Omer Dembinsky, Data Research Manager at Check Point Research. “Every region is seeing more attacks than in 2025, employees are sharing sensitive data with GenAI tools at a growing rate, and ransomware groups are building AI into their operations. Defenders need to prevent attacks earlier, with AI-powered protection and shared intelligence working together across networks, cloud, email, endpoints and AI services.”
Education Remains the Top Target, Agriculture Posts the Steepest Rise
No sector faced more attacks than Education, where each organisation was hit 5,934 times a week on average, 33% more than a year earlier. Schools, universities and research bodies tend to have large user populations and open, widely accessible networks, which probably explains the gap. Agriculture came second with 3,218 weekly attacks per organisation, a jump of 93% year on year and the biggest increase among the leading sectors, while Telecommunications followed closely with 3,068 (+19%). Notably, all tracked sectors experienced double digit growth in attacks from last year, with several highly critical sectors such as Government, Energy & Utilities and Healthcare & Medical also placing in the top half of the ranking. Together, the results show how heavily attackers are targeting industries with large user bases, essential services and sprawling digital estates.
Africa Sees the Most Attacks, but Europe Is Growing Fastest
By region, Africa had the heaviest load and returned to the top of the table for the first time in over a year, with organisations facing 3,834 attacks per week on average (+38% year on year). Latin America followed with 3,483 and APAC with 3,436. Europe, however, saw the steepest growth of all, with attacks 39% higher than in October 2025, ahead of Africa’s 38% and North America’s 33% rise. European organisations still face fewer attacks in absolute terms than those in the top three regions, but the pace of increase points to a rapidly worsening threat environment.Advertisement
Risky GenAI Prompts Continue to Climb
Roughly 1 in 35 enterprise GenAI prompts in October (2.9%) carried a high risk of leaking sensitive data, and this affected 90% of the organisations that use GenAI tools regularly. Another 12% of prompts included information that could be sensitive. The high-risk rate has increased every month in the past quarter, from 2.3% (1 in 43) in August and 2.5% (1 in 39) in September to the current figure. Each user sent an average of 91 prompts during the month, and each organisation relied on seven GenAI tools on average. As the risk of data leakage via prompts in AI tools become more common, companies need a clear view of what staff share with these tools, where the data goes and which safeguards apply.
The data being exposed is central to how businesses run. Financial information was the category seen most often, appearing in GenAI prompts at 71% of organisations. Legal and regulatory material, and network and IT infrastructure details, were each observed at 70%, HR and employee data at 67%, and personally identifiable information at 62%. These figures show how many organisations were affected, not how many prompts were involved. Infrastructure details such as hardware and network configurations or IP addresses are particularly valuable to attackers, since they reveal how an internal environment is built.
Exposure varied widely by industry and location. Business Services topped the list with 5.4% of prompts rated high risk (1 in 19 prompts) – almost double the global average, ahead of Government at 4.6% and Financial Services at 4.5% (both roughly 1 in 22). Regionally, Latin America stood out at 3.8% (1 in 26), well above the 2.9% global average, followed by North America at 3.3% (1 in 30) and APAC at 2.5% (1 in 40). The pattern suggests that organisations handling client, financial, citizen or patient data need AI governance tailored to their sector.Advertisement
Phishing Recedes from September, with Links Still the Preferred Lure
Phishing was less common in October: 1 in 128 emails (0.78%) was malicious, compared with 1 in 91 (1.10%) the month before. Of those emails, 79% included a link and 14% an attachment, so malicious links remain the main way attackers reach victims, although some messages contained neither and relied purely on social engineering. North America had the highest regional rate at 0.81% (1 in 123). Among industries, Construction and Engineering was hit hardest at 1.72% (1 in 58), more than double the global average, ahead of Real Estate, Rentals and Leasing at 1.05% and Associations and Nonprofits at 0.97%.Advertisement
Ransomware Up 35% Year on Year as Business Services Takes the Hardest Hit
Ransomware extortion groups publicly claimed 1,063 victims in October, 35% more than in the same month of 2025, and the largest amount published in a single month to date. Business Services accounted for 31.5% of them, ahead of Consumer Goods and Services (14.9%) and Industrial Manufacturing (11.6%). Providers in the Business Services sector often hold data or system access for several clients at once, so a single breach can spread well beyond the company directly affected. By geography, North America made up 48% of claimed victims, Europe 22% and APAC 18%, and the United States alone represented 44.3%, far ahead of Germany (5.2%) and Canada (4.0%). These figures reflect where claimed victims are concentrated rather than the risk to any individual organisation.
The Gentlemen Continues to Lead While Newcomer n0n Reaches the Top Three
The Gentlemen was the busiest group in October, behind 13% of published attacks, with Qilin close behind at 12%. In third place was n0n, with 8%, a sharp rise from 2% in September, the month it first appeared. n0n is a data-theft and extortion operation whose operators relies heavily on AI-assisted tools, a sign of how the usage of GenAI can assist threat actors in accelerating and amplifying their malicious activity and global reach. The number of active groups has held steady for three months, as newcomers appeared while others went quiet.
October’s results highlight why organisations should act on exposure before attackers do. A prevention-first strategy that combines AI-powered protection, shared threat intelligence and consistent governance can help security teams stop threats earlier across networks, cloud, digital workspaces and AI systems, while simplifying operations and supporting the safe adoption of AI.
For more insights into October 2026 cyber threat trends, visit the Check Point Research blog: https://blog.checkpoint.com/research/october-2026-cyber-threat-landscape-record-ransomware-rising-genai-risk-and-an-ai-powered-newcomer/
Follow Check Point on LinkedIn, X (formerly Twitter), Facebook, YouTube and our blog.
About Check Point Software Technologies
Check Point Software Technologies Ltd. is a global cyber security leader protecting more than 100,000 organisations worldwide. Its mission is to secure enterprises’ AI transformation. With a prevention-first approach and an open ecosystem architecture, Check Point helps organisations block advanced threats, prioritise exposures, and automate security operations across complex digital environments. The unified architecture simplifies protection across hybrid networks, multi-cloud environments, digital workspaces, and AI systems. Structured around four strategic pillars, Hybrid Mesh Network Security, Workspace Security, Exposure Management, and AI Security, Check Point delivers consistent protection and visibility across multivendor environments, enabling organisations to reduce risk, improve efficiency, and accelerate innovation without increasing complexity.Advertisement
——————————————————–
Click Here For The Original Source.
