Key Findings
- The number of newly formed ransomware groups increased by 30% during the 12 months to the end of October 2025
- New, white-label Ransomware-as-a-Service (RaaS) platforms now enable cybercriminal groups to create their own brands
- Cybercriminal groups are abandoning encryption in favour of pure data exfiltration for faster, lower-cost cyber-attacks
- First evidence of a nation-state-backed threat group leveraging Claude’s agentic capabilities to orchestrate attacks, with AI agents performing up to 90% of the intrusion activity
- Russia, China, and Iran continue to pose severe threats to the public sector globally
- Cyber activity targeting the public sector increased by 13% with over 100 countries impacted
- A total of 102 countries were affected, with attacks concentrated against India, Israel, and the US
- Although ransomware targeting decreased by 12%, data breaches increased by 66%, showing a clear shift toward data-theft-driven extortion
- Despite Distributed Denial of Service (DDoS) attacks rising by only 5%, DDoS accounts for the vast number of attacks, highlighting its continued use for political protest

Why Financial Services Remain a Priority Target
Cyber activity against the financial services sector rose sharply across the last reporting year. This reflects the sector’s continued appeal to both financially motivated groups and state-linked actors due to the high value of financial records and the perceived ability to pay.
Ransomware targeting the sector increased, alongside a significant rise in data breaches, highlighting the continued hostile intent for data-centric extortion and financial gain the sector is historically known for.


About the Global Cyber Risk Intelligence Outlook 2026
The Global Cyber Risk Intelligence Outlook 2026 reflects the rigorous analysis and strategic foresight of Quorum Cyber’s Threat Intelligence team, examining how the events of 2025 reshaped global cyber risk and identifying the trends most likely to define the year ahead.
This Financial Services industry guide forms part of the wider Global Cyber Risk Intelligence Outlook 2026 and should be read alongside the main report for broader cross-sector context.

Take Action
Every sector faces cyber security challenges. Our range of managed security services and incident response services are designed to defend and protect organisations wherever they are on their security journey.
To explore how intelligence-led security approaches translate into practical defensive outcomes, organisations are encouraged to participate in the Microsoft Threat Protection Workshop.

Over the past year, we have witnessed a marked acceleration in the capability and ambition of threat actors. The proliferation of AI-enabled tooling, combined with an increasingly professionalised cybercriminal economy, has lowered barriers to entry and expanded the reach of even modestly skilled actors. This report distils the most significant developments observed across our intelligence, incident response, and counter extortion work, offering practical guidance to help organisations anticipate and mitigate emerging risks.
Paul Caiazzo
Chief Threat Officer
Quorum Cyber
Secure Your Future with Expert Intelligence
This report distils the most significant developments observed across our intelligence, incident response, and counter extortion work, offering practical guidance to help organisations anticipate and mitigate emerging risks.
As we look to 2026, our commitment remains steadfast: to provide the intelligence, clarity, and support needed to outpace adversaries in an increasingly complex threat landscape.




