Key takeaways
- Organizations experienced 2,550 weekly cyber attacks on average in October, down 9% month over month but up 32% year over year.
- Education remained the most targeted sector, averaging 5,934 weekly attacks per organization, a 33% year-over-year increase, as all 23 tracked sectors saw double digit growth compared to last year.
- Europe recorded the sharpest regional rise at 39% year over year, while Africa faced the highest volume at 3,834 weekly attacks per organization.
- One in every 35 enterprise GenAI prompts posed a high risk of sensitive data leakage, affecting 90% of organizations that regularly use GenAI tools.
- One in every 128 emails was classified as phishing, down from 1 in 91 in September; 79% of phishing emails contained links.
- A total of 1,063 ransomware attacks were reported, the highest in recent years, and 35% more than in October 2025.
- New n0n extortion group enters top 3 within a month after initial operation, relying heavily on AI-assisted tooling
October’s data shows a more mixed picture. Weekly attack volumes eased from September and phishing became less frequent, but attacks remain one third higher than a year ago, high-risk GenAI prompts continued to rise, and ransomware reached a record 1,063 reported attacks, with a new actor entering the top three. Together, these findings reinforce Check Point’s prevention-first view: organizations need AI-powered security, consistent visibility and shared intelligence across the full attack surface to reduce risk before it becomes business impact.
Global Cyber Attacks Ease from September but Stay Well Above Last Year
Organizations experienced an average of 2,550 cyber attacks per week in October 2026. That represents a 9% decrease from September, but still a 32% increase compared to October 2025. The monthly dip should not be read as a change in direction: attack levels remain roughly a third higher than a year ago, making resilience, exposure reduction and prevention increasingly important across networks, cloud, endpoints, email and AI services.
Education Still Faces the Highest Attack Volume While Agriculture Surges
Education remained the most targeted industry in October, averaging 5,934 weekly attacks per organization, up 33% year over year. The sector continues to face far more attacks than any other, likely reflecting the broad user base and open digital environments of schools, universities and research institutions.
Agriculture ranked second with 3,218 weekly attacks per organization, a 93% increase year over year, closely followed by Telecommunications with 3,068, up 19%. Notably, all tracked sectors recorded a double digit growth from last year, with several highly critical sectors such as Government, Energy & Utilities and Healthcare & Medical also placing in the top half of the ranking. These figures show sustained pressure on sectors with broad user bases, essential services and complex digital environments.
Africa Leads in Volume as Europe Records the Sharpest Increase
Africa recorded the highest regional attack volume in October and climbed back to top place for the first time since September 2025, averaging 3,834 weekly attacks per organization, up 38% year over year. Latin America ranked second at 3,483 weekly attacks, followed by APAC at 3,436. Europe experienced the highest rate of growth, with attacks increasing 39% compared to October 2025. North America also rose sharply, up 33% year over year. Although Europe’s overall volume remains lower than that of the leading regions, it recorded the fastest growth of any region, signaling an intensifying threat environment for organizations there.
GenAI Risk Keeps Rising
In October, 1 in every 35 enterprise GenAI prompts posed a high risk of sensitive data leakage, affecting 90% of organizations that regularly use GenAI tools. A further 12% of prompts contained potentially sensitive information, keeping data exposure a mainstream governance concern. The global high-risk rate has risen steadily, from 2.3% (1 in 43) in August to 2.5% (1 in 39) in September and 2.9% (1 in 35) in October. The average user generated 91 prompts during the month, and each organization used an average of seven tools. With the risk of data leakage via prompts on the rise, it is increasingly important to understand what employees share, where it is processed and which controls apply.
Latin America recorded the highest regional rate of high-risk prompts at 1 in 26 (3.8%), above the global average. North America followed at 1 in 30 (3.3%) and APAC at 1 in 40 (2.5%). Given the average usage per user, this means that across the globe each user is likely submitting between 2 and 4 prompts which might expose sensitive data per month.
By industry, Business Services had the highest high-risk exposure rate at 5.4%, or 1 in every 19 prompts – almost double the global average. Government followed at 4.6% and Financial Services at 4.5%, with Healthcare & Medical and Information Technology also above the global average. These sectors routinely handle client, financial, citizen and patient information, which helps explain their greater exposure.
Sensitive Data Exposure Spans Core Business Information
Financial Data was the most common sensitive-data category, observed in GenAI prompts at 71% of organizations. Legal and Regulatory data and Network and IT Infrastructure followed at 70% each, Employee and HR data at 67%, and personally identifiable information at 62%. These percentages reflect the share of organizations where each category was observed, not the share of prompts. Network and IT Infrastructure information, such as hardware and network configurations and IP addresses, could give attackers valuable insight into an organization’s internal environment if exposed.
Email Phishing Risk Declines from September
One in every 128 emails, or 0.78%, was classified as phishing in October, down from 1 in 91 (1.10%) in September. Among phishing emails, 79% contained links and 14% contained attachments, confirming malicious links as the primary delivery method. Some phishing emails contained neither and relied on social engineering alone. Although phishing was slightly less frequent than in September, the heavy reliance on links underlines the importance of checking URLs before users click.
North America recorded the highest regional phishing rate, with 1 in 123 emails, or 0.81%, classified as malicious.
By industry, Construction & Engineering had the highest rate at 1.72% (1 in 58 emails), reflecting more than double the global average risk for phishing emails to employees in this sector. Real Estate, Rentals & Leasing followed at 1.05% (1 in 96), and Associations & Nonprofits at 0.97%(1 in 103..
Ransomware Climbs 35% Year over Year
* Ransomware data is drawn from double-extortion groups’ public “shame sites.” Although these sources have inherent biases, they provide useful insight into the ransomware landscape.
A total of 1,063 ransomware attacks were reported in October, representing a 35% increase compared with October 2025, and is the highest number reported to date. Business Services was the most targeted industry, accounting for 31.5% of reported victims. Consumer Goods & Services followed at 14.9%, with Industrial Manufacturing at 11.6%. Because business services providers often hold data or system access on behalf of multiple clients, a single incident can have consequences that extend beyond the organization itself.
North America was the most affected region, accounting for 48% of reported ransomware incidents, followed by Europe at 22% and APAC at 18%. The United States accounted for 44.3% of reported victims, substantially ahead of Germany at 5.2% and Canada at 4.0%. These figures show where publicly claimed victims are concentrated, rather than the level of risk faced by an individual organization in each country.
The Gentlemen Leads the Ransomware Rankings as n0n Enters the Top Three
The Gentlemen was the most prevalent ransomware group in October, responsible for 13% of published attacks. Qilin followed with 12%, while n0n accounted for 8%, entering the top three only one month after appearing for the first time, and quadrupling its monthly share of published victims. The number of active groups has remained stable over the past three months, as new groups became active while others did not show continuous operations.
- The Gentlemen: A fast-growing Ransomware-as-a-Service operation founded in mid-2025. It operates as both a RaaS provider and an Initial Access Broker, offering affiliates access to approximately 14,000 pre-exploited FortiGate devices, and supports Windows, Linux and ESXi environments.
- Qilin: An established Ransomware-as-a-Service group with victim disclosures dating back to 2022. It provides affiliates with encryption, negotiation and support infrastructure, and has significantly increased its victim listings since March 2025.
- n0n: A data-theft and extortion operation that emerged in September 2026 and had claimed more than 170 victims by early November. Its operators made extensive use of AI-assisted tooling, and initial access in observed cases relied on weak or stolen credentials rather than exploited vulnerabilities.
What October Tells Us
October’s figures show the average cyber risk easing month over month but remaining high year over year. Weekly attacks per organization fell 9% from September, and phishing became less frequent, yet attack rates are up in every region and industry compared with last year, high-risk GenAI prompts exposing organizations to data leakage continued to rise, and ransomware remained well above last year’s level and reached a new all time high. The quick rise of n0n, whose operators relied heavily on commercial generative-AI platforms, illustrates how adoption of AI tools accelerates and amplifies the operations and threats posed by attackers.
Organizations should focus on reducing exposure early, before attackers can act on it. Check Point’s prevention-first approach brings together AI-powered protection, shared intelligence and consistent governance across hybrid networks, cloud environments, digital workspaces and AI systems. As established and emerging risks converge, a unified security architecture can help teams prevent threats earlier, reduce complexity and secure AI adoption with greater confidence.
