Check Point Research has published data showing that 707 ransomware attacks were recorded globally in April 2026, representing a 5% increase month-on-month and a 12% increase compared to the same period in 2025. Europe absorbed 27% of those incidents, making it the second most targeted region after North America. The data confirms a trend that has been building throughout the year: ransomware is not plateauing — it is accelerating.

The broader threat landscape mirrors this trajectory. Organisations globally faced an average of 2,201 weekly cyberattacks in April 2026, a 10% increase over the previous month and an 8% rise year-on-year. In the United Kingdom alone, the weekly average stood at 1,464 attacks per organisation. Business services firms were disproportionately targeted, accounting for 33.8% of ransomware victims — a pattern consistent with threat actors focusing on organisations that hold large volumes of client data and operate under contractual pressure to maintain service continuity.

The sustained growth in ransomware volumes has implications that extend well beyond incident response. Under the GDPR, a ransomware attack that encrypts or exfiltrates personal data constitutes a personal data breach requiring assessment against the Article 33 notification threshold. The European Commission's proposed amendments to NIS2, published in January 2026, would go further — introducing ransomware-specific reporting requirements, including whether a ransom demand was received, whether payment was made, and the identity of the recipient.

For compliance teams, the convergence of ransomware frequency and expanding regulatory expectations means that breach preparedness can no longer be treated as an annual tabletop exercise. It requires tested procedures, documented decision-making frameworks, and the ability to produce accurate assessments under pressure within the 72-hour notification window.

Acompli perspective: Every ransomware incident is simultaneously a cybersecurity event and a data protection event — and regulators expect organisations to treat it as both. The foundations are consistent: accurate data mapping so you know what data was affected, maintained records of processing to support your notification, and a risk management framework that enables your team to make defensible decisions about notification, containment, and recovery without starting from scratch each time.