Brazil entered 2026 on the list of the ten countries worst hit by ransomware worldwide, accounting for around 2% of global victims in the first quarter. The number is small in proportion and large in consequence.

A market that consolidated and grew at the same time

Two apparently contradictory trends define the year. On one side, concentration: the ten largest groups accounted for 71% of all global victims, a sign of more structured operations capable of scale. On the other, fragmentation: the number of active groups reached 93 in the second quarter of 2026, the highest level ever recorded.

Read together, it is uncomfortable. There are a few highly efficient operators and a long tail of smaller groups testing targets that previously were not worth the effort.

Who is attacking Brazil

Groups with recorded activity in the country include LockBit, The Gentlemen, Krybit, Spacebears, APT73 and Coinbase Cartel. LockBit, even after the international law enforcement operations that dismantled part of its infrastructure, has again widened its presence outside the North American market — Brazil, Italy and Turkey among the destinations.

Most targeted sectors

Government, financial services and education lead in the country. Industry, manufacturing, healthcare and business services remain among the most affected, for a simple reason: high operational dependency. Where a production stoppage costs a lot per hour, extortion has more bargaining power.

What actually reduces risk

• Multi-factor authentication on all remote access, with no exception for suppliers.

• Prioritized patching of edge assets — that is where most intrusions begin.

• Backups isolated from the production network, with restoration tested, not merely scheduled.

• Segmentation that stops an office credential from reaching the industrial environment.

• Monitoring with the capacity to respond within hours: between initial access and encryption, the average is still counted in days.