Set Trending Topics as a preferred source on Google.
If you are on the front lines of a conflict, you are also on the front lines of cyberwar. That is the message of Microsoft’s new Digital Defense Report 2026: A quarter of all attacks on customers observed by Microsoft hit the United States, followed by two countries at war, Israel and Ukraine. Taiwan ranks fourth, and Germany is the only European Union country to make the top 10. At the same time, Microsoft warns that artificial intelligence is making attacks faster, cheaper and harder to detect.
The Top 10 Hardest-Hit Countries
For the ranking, Microsoft analyzed how often customers in each country were targeted by malicious activity in the first half of 2026. The share indicates how much of all attacks observed worldwide fell on each country.
| Rank | Country | Share of All Attacks |
|---|---|---|
| 1 | United States | 25.5% |
| 2 | Israel | 7.6% |
| 3 | Ukraine | 4.8% |
| 4 | Taiwan | 3.9% |
| 5 | United Kingdom | 3.8% |
| 6 | United Arab Emirates | 2.8% |
| 7 | India | 2.5% |
| 8 | Japan | 2.5% |
| 9 | Canada | 1.8% |
| 10 | Germany | 1.7% |
The list mainly reflects geopolitical conflicts. According to the report, Ukraine and NATO countries remain focal points for Russian attackers, while Chinese state-backed groups concentrate on the Indo-Pacific, the United States and strategic technology hubs. Taiwan, for example, was recently the target of a campaign using A.I. agents that was uncovered by the Israeli-Austrian cybersecurity company Dream. Microsoft is also seeing more cybercrime in Latin America, Africa and Southeast Asia, regions where digitalization is advancing quickly but defenses are often still weaker. Other European countries trail far behind, with France at No. 17, Switzerland at No. 39 and Austria at No. 66.
Ransomware Booms in Europe
The threat from ransomware, malicious software that encrypts data for extortion, is growing fastest in Europe. The number of cases Microsoft recorded in Germany rose from 59 to 222 year over year, an increase of 276 percent. In Italy, the number nearly tripled, and in Switzerland it more than doubled. The United States remains by far the most affected country, with 1,087 cases, while attacks on Israel rose by 21 percent. Microsoft suggests that Iran may be using ransomware as a tool of hybrid warfare.
Microsoft names Qilin and Akira as the most active ransomware families. Qilin is popular with criminals partly because its operators let their affiliates keep 80 to 85 percent of ransom payments, more than most other ransomware services. Overall, ransomware detonations against enterprises rose by 15.8 percent.
A.I. Speeds Up Attacks
Microsoft sees artificial intelligence as the biggest disruption. Attackers use A.I. to operate faster and at greater scale, while defenders use it to detect threats more quickly. At the same time, A.I. systems are becoming targets themselves: Microsoft discovered a malicious browser extension with more than 600,000 installs that harvested conversation histories from ChatGPT and DeepSeek and affected nearly 10,000 organizations. By 2028, industry projections suggest around 1.3 billion A.I. agents could be in production, all of which will need to be secured. How quickly offensive A.I. capabilities are spreading to openly available models was recently shown by the Chinese model GLM-5.3.
More figures from the report:
- Data theft: Data was stolen in 63 percent of intrusions.
- Cloud: On average, it took just 5.3 hours for exposed cloud workloads to be attacked.
- Voice phishing: In 93 percent of calls, scammers kept victims on the line long enough to begin manipulating them.
- Business email impersonation: Microsoft detected more than 46 million attacks impersonating businesses over the past 12 months.
Digital identities, meaning stolen credentials and accounts, remain the main entry point for attackers. Microsoft therefore recommends passkeys and phishing-resistant multifactor authentication.
What the Ranking Shows
The country ranking does have its limits. It measures how often Microsoft customers in a country are attacked, so it also depends on how many people and companies there use Microsoft products. Large markets with many customers, such as the United States, almost automatically rank higher than small ones. Moreover, Microsoft relies solely on its own data, which it says amounts to more than 165 trillion security signals a day. Attacks on systems from other vendors are not included.
