Global cyber attacks increased by 16% year-on-year in July 2026, according to Check Point Research. Ransomware incidents nearly doubled, while generative AI emerged as a significant operational risk, with one in 36 enterprise prompts carrying data leakage threats. Education remains the most targeted industry globally, as regional attacks in Africa and Latin America hit record highs.
African organisations recorded 3,237 attacks per week, topped by Latin America at 3,561 weekly attacks per organisation, and APAC at 3,316. In the region, Angola was particularly hard hit with 5,714 weekly attacks per organisation, followed by Nigeria at 4,975, Kenya at
2,915 and South Africa at 2,195.
July’s cyber threat landscape was shaped by pressure across multiple fronts. Financial Services, Government and Energy & Utility sectors continued to take a pummeling, being the top three most attacked industries on the continent.
Global attack volumes continued to climb, ransomware activity broke from the more stable pattern seen earlier in the year, and GenAI exposure became a clearer operational risk as employees used more tools and generated more prompts across the enterprise
“July’s data shows that cyber risk is accumulating across multiple fronts at once,” said Lorna Hardie, Regional Director: Africa at Check Point Research. “Attack volumes continue to rise, ransomware has accelerated sharply, and GenAI exposure is now part of daily business activity. Organisations need prevention-first, AI-driven security that protects networks, users, data and AI workflows before attacks can cause impact.”
Education Remains the Most Targeted Industry as Energy and Hospitality Rise
In July, Education remained the most targeted sector globally, averaging 4,848 weekly attacks per organisation, up 14% year on year. Government followed with 3,044 attacks, Telecommunications with 2,927, while Energy and Utilities rose 20% to 2,759 and Hospitality, Travel and Recreation entered the top five with 2,614 attacks, up 28%.
GenAI Risk Moves from Theory to Daily Business Reality
GenAI-related exposure became a daily business issue in July: one in every 36 enterprise prompts carried a high risk of sensitive data leakage, 88% of regular GenAI-using organisations were affected by high-risk prompt activity, and 22% of prompts contained potentially sensitive information.
Organisations used an average of eight GenAI tools, with users generating 95 prompts on average. Personal data was the most common sensitive category exposed, appearing in 70% of organisations, followed by financial data and network and IT infrastructure at 68% each.
Email Remains a Key Entry Point for Cyber Risk
Email also remained a high-volume risk channel: one in every 128 emails, or 0.78%, was classified as phishing, while a further 20% fell into unwanted or risky categories such as graymail, spam and suspicious messages. Africa recorded the highest phishing rate, at one in every 106 emails, followed by North America at one in every 117, reinforcing email’s role as a common starting point for credential theft, malware delivery and business email compromise.
Ransomware Breaks the Pattern as Reported Victims Surge
The clearest shift in July came from ransomware. Reported attacks reached 964, up 49% from June and 87% compared with July 2025. This marked a decisive break from the first half of 2026, when monthly ransomware activity averaged around 672 incidents. Business Services remained the most affected sector, accounting for 32.5% of reported victims, followed by Industrial Manufacturing at 14.4% and Consumer Goods and Services at 13.4%.
North America remained the most affected region, accounting for 45% of reported ransomware incidents. Europe followed at 28%, while APAC accounted for 17%. At country level, the United States continued to dominate the victim count with 39.4% of reported attacks, followed by Germany, Canada, the United Kingdom and Italy.
The Gentlemen and Qilin Lead as the Ransomware Landscape Shifts
The Gentlemen and Qilin were the most prevalent ransomware groups in July, each responsible for 14% of published attacks. DeadLock ranked third with 10% and 97 reported victims, highlighting continued shifts in the ransomware ecosystem.
