Ransomware hit a new high. Prove you can restore

Ransomware activity just set a new high, and the businesses being hit hardest are not large enterprises. Most mid-size companies have backups and a disaster recovery plan on paper. Far fewer have proven they can restore operations, how long it takes, and who makes the calls while it happens. Before you renew a backup service, a managed IT contract or a cyber insurance policy, find out whether your recovery works.

What the latest numbers show

Nord Security's NordStellar ransomware statistics counted 2,894 ransomware attacks in the third quarter of 2026. That is up about 8.6% from the second quarter and nearly 50% from 1,933 in the same quarter of 2025. Nord Security describes it as the busiest quarter in more than a year. The United States accounted for 805 of those attacks, far more than any other country. Insurance Journal also reported the findings and noted that some groups now skip encryption and simply steal data.

The size of the victims matters most for mid-size buyers. About two in three victims had 200 or fewer employees, and companies with 11 to 200 staff absorbed nearly half of the attacks. By revenue, the $5 million to $50 million bracket was the most targeted. Manufacturing remained the most attacked sector, and healthcare showed the sharpest increase.

Keep the method in mind. These counts come from monitoring more than 200 leak sites and the dark web, and Nord Security is a security vendor. Victims who are never named publicly do not appear, and Nord Security notes that late-reported victims push totals up over time. The real number is likely higher.

Having backups is not the same as having recovery

A second piece of vendor research, the Proofpoint MSP 2027 Ransomware Report, surveyed 400 IT and cybersecurity professionals in July and August 2026. Ninety-one percent said they protect backup storage against ransomware, and 84% said they have a disaster recovery plan. Yet 45% said they are not confident in their organization's ransomware protection strategy.

That gap is the useful finding. Most organizations have bought the pieces. Many are not sure the pieces work together under pressure. The same survey found that among organizations hit by ransomware, 52% cited email or phishing as the entry point, up from 46% the year before. Only 9% believed their staff could reliably recognize an AI-generated phishing or impersonation attempt.

What the federal guidance asks for

The #StopRansomware Guide from CISA and its partners is plain about this. It calls for offline, encrypted backups of critical data, because many ransomware variants look for reachable backups and delete or encrypt them. It says to regularly test the availability and integrity of backups in a disaster recovery scenario. It recommends maintaining updated golden images of critical systems so they can be rebuilt quickly. It also says to create and regularly exercise an incident response plan, with a hard copy and an offline version available.

The guide adds a caution worth repeating to anyone selling you immutable storage: it can help, but CISA notes it does not meet compliance criteria for certain regulations. Check that against your own obligations before you treat it as the answer.

Five questions to answer before your next renewal

• When did we last restore a complete critical system end to end, and how long did it take? Get the date and the time in writing.
• Is at least one copy of our backups offline or otherwise unreachable with the same administrator credentials an attacker would steal?
• What recovery time and data loss can each critical application tolerate, and does the current setup meet it? Finance, ERP, phones and the contact center often have very different answers.
• Who declares an incident, who calls the insurer and outside counsel, and who talks to customers? Do those people have the plan when email and file shares are down?
• If an attacker steals data without encrypting anything, how would we know, and what would we do first?

Who owns recovery

In many mid-size businesses, backup is split between an internal IT lead, a managed service provider, a backup vendor and a cloud platform. Each assumes another owns the full restore. Write down who is responsible for each system, who runs the test, and who signs off on the result. Then put the test on the calendar at least once a year, and after any major change to core systems.

If your provider resists a real restore test, ask why. A provider that is confident in its service usually welcomes the chance to show it. A quick tabletop exercise with leadership is also a low-cost way to find gaps in decisions and contact lists before an attacker does.

How StrategIQ IT can help

Before founding StrategIQ IT, Brian spent years as the enterprise customer accountable for technology, and then built a practice on the partner side around what he wanted as a buyer. We can help you map what is actually protected, set realistic recovery targets for each critical system, and compare backup, disaster recovery and managed security options side by side. We are vendor-agnostic by design. Our partnerships span more than 200 providers, and in most cases StrategIQ is paid by whichever provider you choose, so we have no reason to steer you to one platform. Working through us does not raise your price, and our market knowledge often helps with pricing and terms. Our disaster recovery checklist is a practical place to start. If recovery testing and provider oversight keep landing on nobody's desk, our fractional CIO / CTO service provides ongoing senior technology leadership to own it. Scope, fees and how StrategIQ is paid are explained before you proceed. The first 20-minute conversation is free.