Global Cyber Attacks Rose 48% During September 2026
Threat actors targeted education and business services at record levels, driven by surges in phishing and GenAI data exposure.
Updated on Oct. 12, 2026 in Cybersecurity
Live Poll
Do you feel confident that your personal data is secure when using digital and AI tools?
Global cyber attacks increased by 48% year-on-year in September 2026, reaching an average of 2,803 weekly incidents per organization. The education sector faced the highest pressure, with an average of 6,656 attacks per organization.
Why it matters
The rise in attacks on the education sector coincided with the start of the academic year, while increased reliance on GenAI tools introduced new vulnerabilities for sensitive data leakage. These trends underscore an expanding attack surface for both enterprise and institutional networks.
Organizations encountered an average of 2,803 weekly attacks, while 31.3% of 824 reported ransomware events targeted the Business Services sector. The Gentlemen ransomware group executed 13% of all published attacks, outpacing other identified threat actors.
The players
The Gentlemen
A ransomware operator responsible for 13% of all published cyber attacks in September 2026.
Check Point Research
The security intelligence unit that tracks global threat landscapes and enterprise-level vulnerability data.
The details
Attackers primarily utilized phishing, with 1.1% of all email volume flagged as malicious; of these, 81% contained malicious links and 11% held malicious attachments. Internal security risks shifted toward Generative AI, where one in every 39 enterprise prompts presented a high risk of sensitive data exposure. The average user engaged with these tools 131 times monthly, creating a consistent pipeline for potential unauthorized information egress.
Timeline
September 2025 served as the baseline for year-on-year attack growth comparisons.
August 2026 provided the baseline for month-on-month metrics.
September 2026 saw a 48% year-on-year surge in global cyber attack volume.
The Tech Race
This surge follows an established pattern of sector-specific targeting aligned with academic and business cycles. It marks a clear shift in threat actor focus from general disruption toward specialized exploitation of enterprise GenAI workflows.
Security teams should prioritize filtering for phishing links, which constituted 81% of malicious emails. Enterprise users must also implement strict guardrails for GenAI prompts, as one in 39 queries currently exposes sensitive data to potential unauthorized access.
The takeaway
The sharp increase in ransomware targeting the business sector signals an urgent need for updated credential and data access protocols. Organizations should audit their GenAI usage policies to mitigate the high-risk exposure rate identified in current workflows.
Further reading
For more on evolving threat surfaces, explore our Cybersecurity section.
More information
View the complete analysis in the Check Point Research blog report.
Source note: This article includes information reported by ITWire.
Live Poll
Do you feel confident that your personal data is secure when using digital and AI tools?
