Organisations around the world came under heavier cyberattack in September, according to new figures from Check Point Research, the threat intelligence arm of Check Point Software Technologies. The firm counted an average of 2,803 attacks on every organisation each week, a 16 percent rise from August and a 48 percent rise from the same month a year earlier.
The report, Check Point's Global Threat Intelligence insights for September 2026, describes pressure building on several fronts at once: attack volumes climbing, phishing becoming more common, ransomware staying well above last year's level, and sensitive data leaking through the everyday use of generative AI tools.
Contents
Schools took the heaviest load
Education was the most targeted sector in the world, averaging 6,656 attacks per organisation each week, up 59 percent on a year earlier and 24 percent on August. Check Point tied the jump to the start of the academic year, when students, staff and parents reconnect to campus networks at the same time. Telecommunications followed with 3,483 weekly attacks per organisation, up 29 percent, and government with 3,443, up 37 percent.
Asia Pacific stayed above the global average
Among regions, Latin America recorded the highest volume at 3,813 weekly attacks per organisation, followed by Africa at 3,701 and Asia Pacific at 3,593. Europe posted the fastest growth of any region, with attacks up 61 percent year on year, ahead of North America at 50 percent. Singapore, a near neighbour of Malaysia, averaged 3,603 weekly attacks per organisation, a 92 percent jump and the second highest rate in Asia Pacific.
One in 39 AI prompts risked a leak
The report's sharpest warning concerns generative AI. Check Point found that one in every 39 prompts typed into enterprise AI tools in September carried a high risk of leaking sensitive data, a pattern it saw at 89 percent of the organisations that use these tools regularly. A further 14 percent of prompts contained potentially sensitive information. The average employee sent 131 prompts during the month, across an average of eight different tools per organisation, which widens the number of places company information can end up.
Ransomware stayed crowded
Ransomware remained well above last year's level. A group calling itself The Gentlemen was behind 13 percent of the attacks published on leak sites in September, ahead of Qilin at 9 percent and Akira at 5 percent. Beyond the leading three, a further 80 extortion groups reported attacks during the month, a sign of how many operators are now active at once.
Check Point framed the figures as a case for a prevention-first approach that watches network, cloud, endpoint, email and AI use together, rather than treating each as a separate problem. For a fuller picture of how attackers are now folding AI into the intrusion itself, see our earlier report on AI running cyberattacks on its own, and on how few companies can actually enforce security on the AI tools they already use. The full September breakdown is published on the Check Point Research blog.
