Poland is not the most heavily targeted country in Europe, but the scale of the cyber threat is growing. Government institutions are already repelling around 3,400 cyberattacks every week. Across the country, organisations face an average of 1,854 attacks per week, while the number of attacks has increased by 15% over the past year. Poland now records more cyberattacks than countries including Switzerland, the Netherlands, France, the United Kingdom and Greece. Ransomware and the growing use of artificial intelligence by cybercriminals are becoming particularly serious threats, according to analysts at Check Point Research.
Findings from Check Point Research show that organisations worldwide are facing an increasingly serious ransomware threat. Cybercriminals are also changing their methods. Instead of relying primarily on encrypting files, they are increasingly stealing sensitive information, selling data on underground markets and using it to extort their victims.
In the second quarter of 2026, 2,139 ransomware victims were publicly disclosed worldwide, up 33% from a year earlier. At the same time, the number of active ransomware groups reached a record 93, compared with 71 groups in 2025.
One of the most significant changes is the gradual shift away from traditional data encryption towards data theft and extortion. The proportion of ransomware victims paying a ransom has fallen from 85% in 2019 to around 23% today. Despite the decline, ransomware-related payments still exceeded $820 million in 2025.
Poland remains on an upward trajectory in terms of cyber threats. Although the country is below the European average of 2,051 attacks per organisation per week, it still faces more attacks than many Western European economies.
The average number of weekly attacks stands at 1,638 in Greece, 1,489 in Switzerland, 1,467 in the Netherlands and 1,597 in the United Kingdom. Countries experiencing higher levels of cyber activity than Poland include Italy, with 2,755 attacks per week, the Czech Republic with 2,671 and Austria with 2,314.
Europe accounted for 28% of publicly disclosed ransomware victims. North America had the largest share at 45%.
At country level, the United States was by far the most heavily affected, accounting for 39.4% of all disclosed victims. Germany followed with 5%, Canada with 4.4%, the United Kingdom with 3.5% and Italy with 3%.
The latest Check Point Research State of Ransomware report also highlights the growing role of artificial intelligence in reducing the cost and complexity of cybercrime.
According to the analysts, it took just three days, with the help of AI-powered coding assistants including DeepSeek and Qwen, to develop infrastructure capable of supporting effective cyberattacks in the case of the group known as The Gentleman.
The report also shows that one of the most active ransomware groups consists of just nine people. By relying on an extensive affiliate network, however, the group has been able to build a cybercrime operation with a global reach.
AI is not yet independently carrying out entire ransomware campaigns. However, researchers say it is already helping criminals develop tools more quickly while reducing the level of technical expertise required to launch sophisticated attacks.
At the same time, the period between the disclosure of a vulnerability and its exploitation by criminals is increasingly being measured in hours or days rather than weeks.
“The most important finding this quarter is not the number of ransomware victims, but how dramatically the barriers to entry are falling,” said Sergey Shykevich, Director of Threat Intelligence at Check Point Software.
According to Shykevich, a small team supported by artificial intelligence and an affiliate network can build a world-class ransomware operation in just a few months.
In practice, this means that ransomware is no longer a threat associated only with a handful of large and highly specialised hacking groups. It is evolving into a mature and scalable criminal industry built around access brokers, credential theft, specialised service providers, affiliate networks and artificial intelligence.
Cyberattacks Are Intensifying Worldwide
Cybercrime is becoming increasingly global. Europe is not currently the world’s most heavily attacked region, but the pace at which the number of incidents is increasing shows that the continent cannot treat cybersecurity as a distant problem.
Organisations in Africa, Asia and the Americas currently face some of the highest levels of cyber activity.
Angola recorded the highest figure, with 5,714 attacks per organisation per week, followed by Nigeria with 4,975 and Colombia with 4,312.
Very high levels were also recorded in Taiwan, with 4,306 weekly attacks, Brazil with 4,151, Mexico with 4,104 and India with 3,547.
Within the Asia-Pacific region, in addition to Taiwan and India, organisations in Singapore face an average of 3,401 attacks per week. China records 2,215, Hong Kong 2,184, Australia 1,996 and New Zealand 1,955.
In the Americas, alongside Colombia, organisations in Brazil and Mexico remain particularly exposed to cyber threats.
Education, Government and Telecommunications Under Attack
Cybercriminals do not choose their targets at random. Education remains the most heavily attacked sector, with 4,848 attacks per organisation per week, an increase of 14% year on year.
Government and public-sector organisations rank second, with 3,044 attacks per week, followed by telecommunications companies with 2,927.
Cyber threats are rising even faster in the energy and utilities sector, where the number of attacks increased by 20%. In hospitality, travel and leisure, the increase reached as much as 28%.
The figures illustrate how the nature of the cyber threat is changing. Large corporations with extensive databases are no longer the only attractive targets.
A successful cyberattack can disrupt a school, government office, telecommunications operator, hotel or a company responsible for part of a country’s critical infrastructure.
