Ransomware Threats to North American Critical Infrastructure: A 2026 Assessment

Executive Summary

As of March 2026, ransomware attacks targeting critical infrastructure in North America have escalated, with threat actors employing increasingly sophisticated tactics. Notable groups such as Rhysida, Royal (also known as BlackSuit), and Vice Society have been identified as primary perpetrators. These attacks have disrupted essential services, including power grids, water systems, and healthcare facilities, highlighting the urgent need for enhanced cybersecurity measures.

Current Threat Landscape

Between January and September 2025, there were 4,701 ransomware incidents globally, a 46% increase from the previous year. Of these, 2,332 attacks (50%) targeted critical infrastructure sectors, marking a 34% year-over-year rise. The United States was the most affected, accounting for approximately 21% of global ransomware activity. (prnewswire.com)

Key Threat Actors

• Rhysida: A ransomware group known for encrypting data and threatening public release unless a ransom is paid. They have targeted large organizations, including entities in the U.S. healthcare sector. (en.wikipedia.org)

• Royal (BlackSuit): Formed in 2022 and renamed BlackSuit in 2024, this group employs double extortion tactics, demanding ransoms ranging from $1 million to $10 million in Bitcoin. They have targeted various critical infrastructure sectors, including chemicals, communications, and healthcare. (en.wikipedia.org)

• Vice Society: Emerging in 2021, Vice Society has been active in ransomware extortion attacks on healthcare, educational, and manufacturing organizations. They have attacked targets in both Europe and the United States, including a major compromise of the Los Angeles Unified School District. (en.wikipedia.org)

Impact on Critical Infrastructure

• Power Grids and Water Systems: Ransomware attacks have the potential to disrupt essential services, leading to widespread outages and public safety concerns. While specific incidents in 2025 are limited, the increasing frequency of attacks suggests a growing risk to these sectors.

• Healthcare Sector: Healthcare organizations have been prime targets due to the sensitive nature of their data. The 2023 attack on the Los Angeles Unified School District underscores the vulnerability of educational institutions, which often share infrastructure with healthcare facilities. (en.wikipedia.org)

Recommendations

Organizations within critical infrastructure sectors should adopt a multi-layered cybersecurity approach, including:

• Regular System Updates: Ensure all systems are up-to-date with the latest security patches.

• Employee Training: Conduct regular training sessions to recognize phishing attempts and other social engineering tactics.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift recovery from potential attacks.

Conclusion

The threat of ransomware attacks on North America's critical infrastructure remains significant. Proactive measures, continuous monitoring, and inter-sector collaboration are essential to mitigate these risks and ensure the resilience of vital services.

Highlights:

• Global Ransomware Attacks Against Critical Industries Surge 34% in 2025, Published on Monday, October 20
• Most ransomware attacks on critical services in 2023 happened in North America or Europe, Published on Monday, February 19
• APT and financial attacks on industrial organizations in H2 2023 | Kaspersky ICS CERT, Published on Monday, April 01