Greetings, Cybersecurity Enthusiasts!

July marked another month of elevated breach activity as defacement campaigns continued at record levels and ransomware remained one of the primary drivers of high-impact incidents. Gentleman retained the top spot among ransomware groups, while higher education remained the most impacted sector. North America continued to account for the largest share of reported incidents despite increasing global activity.

📊 Cyber Incidents Breakdown

Across all monitored sources, we recorded 2,549 breaches in July, up from 2,509 in June. The increase was driven by continued growth in defacement activity alongside sustained ransomware operations.

Source Mix

• Ransomware Posts: 714 (↓ from 722)
• Defacements: 1,257 (↑ from 1,226)
• Hacker Forums: 361 (↑ from 346)
• News Coverage: 173 (↑ from 128)
• Official Reports: 38 (↓ from 81)
• SEC Filings: 5 (↓ from 6)
• Leak Reports: 1 (↑ from 0)

💥 Most Active Ransomware Gangs

The most prolific ransomware groups in July were:

• Gentleman — 136 victims (↑ from 120)
• Qilin — 127 victims (↑ from 77)
• DragonForce — 41 victims (↓ from 48)
• INC — 38 victims (↑ from 32)
• SafePay — 33 victims (new)

Gentleman remained the most active ransomware operation in July, extending its lead with another month of growth. Qilin rebounded sharply after June’s decline, while DragonForce and INC remained persistent threats across multiple industries. SafePay entered the top five as ransomware activity continued to evolve.

🆕 Enhanced Ransomware Gang Tracking

HackNotice expanded intelligence coverage for the following groups due to increased activity and infrastructure visibility:

• CRPX0
• WallStreet
• Doommageddon
• Settra

📰 Breaches That Made the News

Several high-profile breaches captured attention in July:

• Hyundai Turkey: https://app.hacknotice.com/#/hack/6a6df707578c0daf2d909008
• Amgen: https://app.hacknotice.com/#/hack/6a6d2310578c0daf2d016113
• Allstate: https://app.hacknotice.com/#/hack/6a6ad5e9578c0daf2d6e8d3c
• Ernst & Young: https://app.hacknotice.com/#/hack/6a5e106d578c0daf2de86dc2
• Estée Lauder: https://app.hacknotice.com/#/hack/6a5ea4d8578c0daf2dfe9164
• Caterpillar: https://app.hacknotice.com/#/hack/6a5f7a1d578c0daf2dcf412e
• Hugging Face: https://app.hacknotice.com/#/hack/6a5e0ed8578c0daf2de3d0bc

🏭 Industry and Geography Insights

Industries Most Impacted

• Higher Education: 19.9% (↓ from 22.1%)
• Manufacturing: 12.2% (↑ from 11.1%)
• Information: 9.4% (↑ from 8.5%)
• Professional, Scientific, and Technical Services: 8.9% (↓ from 9.9%)
• Government: 7.8% (↑ from 5.8%)

Industry Trends

Higher education remained the most impacted sector despite a modest decline in overall share. Manufacturing continued to gain momentum, while information organizations experienced another month of elevated targeting. Government entities also saw a notable increase, moving into the top five most impacted industries.

🌍 Regions Most Affected

• North America: 44.9% (↓ from 46.6%)
• Europe: 27.8% (↑ from 25.5%)
• Asia: 12.7% (↓ from 13.6%)
• South America: 7.0% (↑ from 6.2%)
• Middle East: 3.2% (↓ from 3.7%)
• Africa: 2.5% (↑ from 1.6%)
• Oceania: 1.9% (↓ from 2.9%)

Regional Trends

North America remained the largest concentration of ransomware and breach activity despite another decline in overall share. Europe continued to gain ground and approached one-third of geographically attributed incidents, while South America also increased its share. Overall activity remained broadly distributed across regions as attackers continued to expand their global reach.

✅ Closing Thoughts

July delivered another month of elevated cyber activity, with overall breaches reaching their highest sustained levels of the year. Gentleman strengthened its lead as the most active ransomware group while Qilin rebounded sharply. Higher education remained the most targeted sector, manufacturing continued its upward trend, and Europe increased its share of global breach activity.

🔍 If you are not tracking ransomware’s role in third-party exposure, you are missing a critical blind spot.

Stay ahead of shifting threats with HackNotice’s real-time intelligence across ransomware, breaches, and dark-web activity.

👉 Request a demo to see how HackNotice helps you manage third-party risk.