Waves of Ransomware Attacks: Copec, IDHS, and the 2026 Escalation

The recent compromises of Chilean distribution chain Copec and the Indiana Department of Health Services (IDHS) information system mark a turning point in the evolution of ransomware in 2026. These two major incidents perfectly illustrate how cybercriminals now leverage artificial intelligence and form strategic alliances to maximize their profits.

While statistics reveal a 213% increase in victims in the first quarter of 2025, 2026 is expected to be even more critical with the emergence of new, particularly formidable attack tactics. For more details on recent statistics and case studies, see New Ransomware Threats 2025: Figures & Case Studies and the National Cyber Threat Assessment 2025-2026.

Anatomy of the Copec and IDHS Attacks: New Infiltration Methods

The compromises of Copec and IDHS began with sophisticated spear-phishing and vishing campaigns, specifically targeting high-privilege credentials. This approach is no longer random: cybercriminals now use artificial intelligence to identify key employees and personalize their lures.

The Deployment of Next-Generation RaaS Loaders

Once initial access was gained, attackers deployed RaaS (Ransomware-as-a-Service) loaders capable of exploiting zero-day vulnerabilities and bypassing multi-factor authentication (MFA) solutions. These tools, powered by AI-based automation scripts, represent a major evolution compared to traditional attacks.

The groups involved in these attacks belong to emerging cybercriminal alliances, notably the Qilin-SafePay-WorldLeaks coalitions which share ransomware creation tools and leak infrastructures.

Double Extortion: When Encryption Meets Disclosure

The major innovation of these attacks lies in the particularly refined double extortion strategy. Operators simultaneously:

• Encrypted the critical databases of both organizations
• Threatened to publish sensitive patient files (IDHS)
• Exposed fuel delivery tracking data (Copec)
• Used sophisticated leak platforms to increase pressure

"Activity began to pick up at the end of the summer with a seasonal resurgence, but also the rapprochement between cybercriminal groups," emphasize NCC Group experts.

This tactic proves particularly effective because it exploits both the operational continuity and the regulatory obligations of the victims.

Sectoral Impact: Energy and Healthcare Under Maximum Pressure

Copec: Energy Supply Paralysis

The attack on Copec caused significant operational damage. The blocking of SCADA systems interrupted the management of service stations, leading to:

• Local fuel shortages in several regions
• Price increases at the pump due to supply disruptions
• Regulatory sanctions for non-compliance with public service obligations

Operational Impact (Copec)	Consequences
SCADA systems blocked	Interruption of service station management
Local fuel shortages	Price increases at the pump
Non-compliance with obligations	Regulatory sanctions

IDHS: Healthcare Chaos and Data Breach

The incident affecting IDHS illustrates the critical vulnerability of the healthcare sector. The paralysis of systems caused:

• Care delays for thousands of patients
• The leak of sensitive data including complete medical records
• Compliance remediation costs estimated at several million dollars

These sectors remain the most lucrative targets for cybercriminals due to their operational criticality and financial capacity.

Evolution of Cybercriminal Tactics in 2026

Artificial Intelligence Serving Crime

2026 attacks are distinguished by the massive integration of generative AI into attack processes. Cybercriminals exploit this technology to:

• Automate reconnaissance of target environments
• Personalize phishing lures at scale
• Optimize ransom demands based on victims' financial profiles

Strategic Alliances and Resource Pooling

The emergence of alliances between ransomware groups marks an industrialization of the sector. These partnerships allow for:

• The sharing of sophisticated tools among different criminal organizations
• The pooling of leak and payment infrastructures
• The exchange of intelligence on targets and vulnerabilities

According to cybersecurity outlooks for 2026, this evolution fundamentally transforms the threat landscape.

Sectors on the Front Line of Threats

Analyses reveal that certain sectors concentrate the attention of cybercriminals:

• Healthcare: 28% of targeted attacks in 2025
• Retail and energy: 22% of recorded incidents
• Manufacturing industry: 18% of compromises

These sectors combine operational criticality, sensitive data, and financial capacity, creating an environment conducive to high ransom demands.

Financial and Operational Costs of Escalation

Direct Financial Impact

Recent studies estimate the average financial impact of a ransomware attack at 1.8 million euros per incident. This estimate includes:

• Business interruption during the encryption period
• Costs of system recovery and reconstruction
• Regulatory penalties and reputational losses
• Post-incident cybersecurity investments

Extended Operational Consequences

Beyond financial aspects, victim organizations face major operational disruptions. The increasing interconnectedness of systems amplifies the impact of each compromise, creating cascading effects across the entire digital ecosystem.

The risks identified for 2026 highlight this interconnectedness issue as a threat amplification factor.

Defense Strategies Adapted to New Threats

Advanced Behavioral Detection

Given the evolution of tactics, organizations must invest in behavioral detection solutions capable of identifying subtle anomalies. These systems analyze activity patterns to detect lateral movements and privilege escalation attempts.

The integration of quantum computing could revolutionize these detection capabilities in the coming years.

Offline Backups and Segmentation

Offline backups remain the last line of defense against ransomware. Implementing air-gapped architectures and regularly tested restoration processes is crucial.

Network segmentation also helps limit the lateral spread of malware, reducing the potential impact of compromises.

Enhanced Inter-sectoral Cooperation

The evolution of threats requires enhanced cooperation between public and private sectors. Sharing threat intelligence and harmonizing response protocols are becoming essential.

Outlook and 2027 Preparation

Trend analysis suggests a continued intensification of ransomware attacks for 2027. Massive investments in cloud computing infrastructure create new attack surfaces that cybercriminals will likely exploit.

Organizations must anticipate this evolution by developing resilience strategies adapted to emerging threats. Implementing regular awareness programs and adopting next-generation protection technologies are absolute priorities.

The emergence of new technologies like professional virtual reality also opens new attack vectors that need to be anticipated.

2026 thus marks a pivotal stage in the evolution of ransomware, characterized by unprecedented technological sophistication and increasing industrialization of cybercriminal operations. The Copec and IDHS cases are just the first examples of a new generation of attacks that are redefining the paradigms of modern cybersecurity.