Japan ransomware study: distinguish incidents from leak-site claims

Findings and evidence

Cisco Talos reports 90 observed ransomware incidents affecting Japanese organizations from January through July 2026, compared with 86 in the corresponding earlier period. It separately examines The Gentlemen’s leak-site activity and evidence associated with Qilin.

Why it matters

Keep the observation window, geographic scope and type of record beside each statistic. Incident reports and criminal leak-site listings measure different things and should not be silently combined.

Scope and limits

Although the source headline refers to the first half, its stated incident comparison includes July. These are observed cases, not an exhaustive national prevalence estimate.

Primary source

Cisco Talos: original publication. Source published 2026-09-17. Brief prepared by websec.gr on 26 September 2026. This is an editorial research summary, not a claim of independent replication.