Password Statistics 2026: 92% of the “Strong” Passwords We Built to Pass Complexity Rules Were Already Breached
These password statistics come from an experiment, not a survey. We checked 12,674 passwords from public lists and obvious patterns against the Have I Been Pwned breach corpus. 92% of the 634 we built to pass a capital, digit and symbol complexity rule were already breached. Of 1,200 random passphrases and strings, 0 were.
100.0%of the public top 10,000 list found in the corpus
0 / 1,200random passphrases and strings found (control)
584,516breach appearances for Password1!, which passes most complexity rules
The pages that rank for “password statistics” today are mostly vendor roundups of third-party survey numbers. This page measures something directly: it takes the rules most companies still enforce, constructs the passwords those rules produce, and counts how many are already sitting in breach dumps. Every number below is a count we computed, with the method shown. NIST’s current standard, SP 800-63B Revision 4, now tells verifiers to stop requiring character mixtures and to check new passwords against exactly this kind of blocklist instead.
The bench
Each experiment below states a hypothesis, the method (the candidate set), and the result. The breach counts come from the Pwned Passwords range API: for a given string, the API returns how many times its hash appears across the breaches Have I Been Pwned has ingested. A count of 0 means the string was not found. We never submit a full hash or a real password; only the first five characters of each SHA-1 hash leave the machine.
Experiment 1 · Baseline
How bad is the public common-password list?
Hypothesis: a widely circulated “top 10,000” list is almost entirely in the breach corpus. Method: the public SecLists 10k-most-common.txt list (10,000 entries); look up each. Result: 10,000 of 10,000 present (100.0%), 2.26 billion appearances combined.
The common-password list is not theoretical: every entry of it is already in known breaches, and together the 10,000 strings account for 2,263,151,776 breach appearances. The most frequent strings dominate: 123456 alone appears 210,461,208 times, and password, ranked 4th, appears 52,372,427 times. The top fifteen:
Length alone does not rescue a popular password. Within this list, the 134 entries of 9 or 10 characters have a higher median count (191,583) than the 5,860 entries of 6 characters or fewer (51,589). Only 21 entries are longer than 10 characters, too few to read a trend from. Median appearances by length:
Length
Entries
Share breached
Median appearances
6 or less
5,860
100.0%
51,589
7 to 8
3,985
100.0%
73,823
9 to 10
134
100.0%
191,583
11 to 12
18
100.0%
3,037
13 or more
3
100.0%
1,880
Experiment 2 · The headline
Do complexity rules produce safe passwords?
Hypothesis: passwords that satisfy a Capital + lowercase + digit + symbol rule are safe from guessing. Method: construct 634 such passwords from predictable patterns (Season/Month/base word + year + symbol); all pass the rule. Result: 582 of 634 already breached (92%).
This is the finding. A password like Welcome2026! or Summer2025! clears almost every corporate complexity policy. It is also exactly the kind of string that turns up in breach dumps: 92% of the set we built is already in the corpus. The named examples:
Password (passes complexity rule)
In corpus
Appearances
Password1!
yes
584,516
Admin123!
yes
252,666
P@ssw0rd!
yes
119,515
Welcome2026!
yes
1,179
Company123!
yes
615
Summer2025!
yes
593
Winter2025!
yes
473
Spring2026!
yes
219
Football2024!
yes
113
Autumn2024!
yes
1
The 8% that got away are mostly this year’s passwords
The misses are not evidence that some patterns are safe. They cluster in the newest years: 97.6% of the 535 complexity passwords without a 2025 or 2026 suffix are already breached, against 78% of those ending in 2025 and 44% of those ending in 2026. That pattern fits breach lag: a password built on the current year has had little time to be leaked and then loaded into Have I Been Pwned. Even so, Welcome2026! already appears 1,179 times.
Year in password
Built
Already breached
Share
2015
49
44
90%
2016
49
47
96%
2017
49
48
98%
2018
49
49
100%
2019
49
48
98%
2020
49
49
100%
2021
49
49
100%
2022
49
49
100%
2023
49
47
96%
2024
49
47
96%
2025
49
38
78%
2026
50
22
44%
The rule asks for four character classes. It does not ask for unpredictability. NIST’s current guidance prohibits composition rules outright.
Experiment 3 · Keyboard walks
Are keyboard patterns any better?
Hypothesis: “random-looking” keyboard walks (qwerty, 1qaz2wsx) avoid the dictionary. Method: 27 common keyboard walks and their complexity-styled variants. Result: 27 of 27 breached (100%).
Keyboard walk
In corpus
Appearances
qwerty
yes
30,812,897
qwerty123
yes
13,871,714
qwertyuiop
yes
8,988,385
1q2w3e4r5t
yes
8,065,276
1q2w3e4r
yes
7,322,046
1qaz2wsx
yes
5,832,052
asdfghjkl
yes
4,534,944
zxcvbnm
yes
4,138,978
Experiment 4 · Year suffixes
Does appending the year help?
Hypothesis: a current year makes a common word unique enough. Method: 10 base words (password, admin, welcome, summer, hello, monkey, dragon, shadow, master, football) + every year from 1950 to 2026. Result: 770 of 770 already breached (100%); peak at 2020.
The year does not help. Every one of the 770 word and year combinations from 1950 to 2026 is in the corpus. Since 2000, decade years stand out: the base words plus 2000 draw 2.5 times the average of the neighbouring years, 2010 draws 2.1 times, and 2020 1.9 times. Earlier decades show no such spike (1990 draws 0.8 times its neighbours). password2020 appears 71,095 times, against 46,536 for password2019 and 27,061 for password2021.
The fall-off on the right edge most likely reflects breach lag, since recent years have had less time to leak, though this test cannot separate lag from any change in habits. password2026 already appears 58 times with the year not yet over. Total breach appearances across the base words, by appended year:
Experiment 5 · Teams and cities
What about a favorite team or city?
Hypothesis: a personal choice (sports team, home city) is obscure enough to be safe. Method: 43 common team and city names. Result: 43 of 43 breached (100%).
Word
In corpus
Appearances
liverpool
yes
1,790,671
barcelona
yes
1,285,680
juventus
yes
1,230,654
chelsea
yes
1,218,619
arsenal
yes
1,067,466
london
yes
994,336
Experiment 6 · The control
Does the method flag everything?
Hypothesis: if the API flagged any string, the results above would be meaningless. Method: 600 random four-word diceware passphrases (EFF wordlist) and 600 random 16-character strings. Result: 0 of 1,200 breached.
None of the 1,200 randomly generated strings appeared in the corpus. The experiments above are detecting human predictability, not an artifact of the data. A passphrase of a few random words lands in the same safe space while staying memorable, which is the direction NIST’s length-first guidance points.
Why the breach corpus still matters even as breaches expose fewer passwords
A companion analysis of Have I Been Pwned found that passwords now appear in only 19% of breaches added in 2026, down from 86% in 2016 to 2019. Fewer new password dumps do not retire the old ones: every entry in Experiment 1 is still in the corpus and still on the wordlists anyone can download. Logins remain a working way in. When we coded CISA’s #StopRansomware advisories by entry technique, valid accounts (MITRE ATT&CK T1078) appeared in 10 of the 22 advisories that published initial access tables, and 7 of those 10 also listed external remote services such as VPN or remote desktop, according to our analysis of ransomware initial access vectors. The other main route, exploiting internet-facing devices, is tracked in our analysis of the CISA known exploited vulnerabilities catalog.
What this means for MSPs and IT teams
Drop composition rules from your policies: a rule that Password1! satisfies gives false assurance, and NIST now prohibits such rules. Follow the current NIST line instead: require length (a 15-character minimum for single-factor secrets), allow long passphrases up to at least 64 characters, stop forcing periodic resets, and screen every new or changed password against a breached-password blocklist at the moment it is set. The Pwned Passwords API used here is free and k-anonymous, so screening can be done without ever sending a client’s password off-site. Pair it with phishing-resistant multi-factor authentication, because a breached password is only dangerous when it is also a sufficient one.
Frequently asked questions
What are the most common passwords in 2026?
In our test of the public SecLists top 10,000 list, the most frequent string was “123456”, which Have I Been Pwned has seen 210,461,208 times across known breaches; “password” ranked 4th with 52,372,427. All 10,000 entries were present in the breach corpus.
Does adding a capital letter, a number and a symbol make a password safe?
No. We built 634 passwords that satisfy a typical complexity rule (at least 8 characters with an uppercase letter, a lowercase letter, a digit and a symbol), using predictable patterns like Season plus Year plus a symbol. 92% of them were already in Have I Been Pwned. Password1! alone appears 584,516 times.
How many passwords did this report test?
We checked 12,674 candidate passwords against the Have I Been Pwned Pwned Passwords API using k-anonymity, so no full password ever left our machine. All candidates came from public lists or obvious patterns; we never queried a real user’s password.
Do random passphrases get breached?
In our control group, 0 of 1,200 randomly generated strings (600 four-word diceware passphrases and 600 random 16-character strings) appeared in the corpus. The method is not flagging everything: only guessable, human-chosen patterns show up.
What does NIST say about password complexity rules?
NIST Special Publication 800-63B Revision 4, published as final in July 2025, says verifiers SHALL NOT impose composition rules such as requiring mixtures of character types, and SHALL NOT require periodic password changes. It does require checking new passwords against a blocklist of known compromised passwords, which is exactly the measurement in this report.
Is appending the year to a password safe?
No. Across common base words plus every year from 1950 to 2026, all 770 combinations were already breached. Decade years since 2000 stand out: “password2020” appears 71,095 times, and “password2026” already appears 58 times.
Source. Have I Been Pwned, Pwned Passwords range API (api.pwnedpasswords.com/range/{prefix}), queried October 2026 with the Add-Padding header and a request rate capped at ten per second. The corpus aggregates passwords exposed in known data breaches.
What the code did. We assembled 12,674 candidate passwords from public lists (the SecLists top 10,000 and the EFF diceware wordlist) and from obvious construction patterns, computed each one’s SHA-1 hash, and sent only the first five hexadecimal characters of each hash to the API (k-anonymity). The API returns the breach count for every hash sharing that five-character prefix; we matched the remaining 35 characters locally to read each candidate’s count. A count of zero means not found.
Privacy. No real user password was ever queried. Every candidate is a public-list entry or an obvious pattern, and no full password or full hash was transmitted. Padding rows returned by the API carry a count of zero and are ignored.
Definitions. “Complexity-rule” means at least eight characters containing an uppercase letter, a lowercase letter, a digit and a symbol. “Breached” means the Pwned Passwords API returns a count of one or more. “Appearances” is that count, the number of times the password has been seen across ingested breaches.
Limitations. The corpus reflects breaches Have I Been Pwned has ingested, not all breaches. A count of zero means not yet observed, not uncrackable. Breach counts reflect popularity in leaked data, not current live use. Our constructed sets are illustrative of common patterns, not an exhaustive enumeration.
Not advice. This is an analysis of public breach data, not a security assessment of any specific account or environment.
Cite as:The Uptime Report. "Password Statistics 2026: 92% of the “Strong” Passwords We Built to Pass Complexity Rules Were Already Breached." October 2026. https://theuptimereport.com/password-statistics-2026/
Ransomware Groups 2026: Qilin Leads, and a Gang First Seen Last September Is Now Second
The most active ransomware groups of 2026 are Qilin, with 1,023 victims posted on its leak site from January to September, and The Gentlemen, with 892, a group first seen in September 2025. Together they posted 24% of all victims. 161 ransomware groups posted at least once, up from 124 in the same months of 2025.
1,023Qilin victims, Jan to Sep 2026, up from 556
892The Gentlemen, from 38 in the same months of 2025
161groups posting, vs 124 a year earlier
84groups first seen in 2026
The most active ransomware groups of 2026
Victims named on each group’s leak site, deduplicated, January to September 2026, by date first seen. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
The top ten groups posted 52% of all 2026 victims, about the same as the 51% of a year earlier. The change is at the very top: the two largest groups posted 24% of victims in 2026, against 16% for the top two in the same months of 2025. Qilin has led since 2025 and nearly doubled. The Gentlemen went from 38 victims in their first weeks of activity in 2025 to 892. LockBit 5, whose leak site first appeared on 2025-12-05, entered at #6. For the month-by-month totals behind these groups, see our ransomware statistics for 2026.
Risers and fallers
Groups in the top 10 of either period, ordered by victims on each side; numbers are victims posted. Red: more victims in 2026. Grey: fewer. Thick lines: a change of 150 or more. Same months in both years, January to September.
The biggest risers were The Gentlemen (38 to 892), Qilin (556 to 1,023), LockBit 5 (0 to 258), DragonForce (145 to 323). The biggest fallers were RansomHub (236 to 0), Babuk-Bjorka (213 to 0), Lynx (241 to 61), Cl0p (418 to 245). Cl0p’s 2025 figure is inflated by mass postings in February 2025 (235 victims on a single day), so its drop says more about that campaign than about a slowdown. Several 2025 leaders went quiet altogether: RansomHub (236 victims in 2025, last post 2025-04-01), Babuk-Bjorka (213 victims in 2025, last post 2025-04-04), Cactus (94 victims in 2025, last post 2025-03-17), FunkSec (91 victims in 2025, last post 2025-03-19) have posted nothing in 2026.
How many ransomware groups are there?
Groups with at least one leak-site post in the year (light) and the subset first seen that year (dark). *2026 is January to September. First seen uses RansomLook’s earliest record for each leak-site name. 2021 is omitted because tracking began that year.
The number of groups posting victims has grown every year in our data, from 61 in 2022 to 140 in 2025, and 161 have posted in the first nine months of 2026. Churn is high: 84 groups were first seen in 2026, and groups first seen in 2025 or 2026 posted 55% of 2026 victims. The long tail is thin: 46 of the 161 groups active in 2026 have posted five victims or fewer, while the top ten account for 52%.
A “new” group is not always new people. Leak sites rebrand, split, and relaunch, and the FBI’s 2025 report lists INC, Lynx, and Sinobi as a single entry: together they posted 507 victims in 2026, against 524 in the same months of 2025, as Lynx posts fell and INC Ransom and Sinobi rose. Counts here are by leak-site name.
Is ransomware getting more concentrated?
Share of each year’s deduplicated leak-site victims posted by the single largest group (red, named under the year), the next four, the next five, and every other group. *2026 is January to September. 2022 includes bulk backfills. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
In 2022 the ten largest groups posted 77% of victims, and LockBit 3.0 alone posted 37%. By 2025 the top ten held 50% and the leader 12%. The field fragmented as dozens of smaller groups opened leak sites. 2026 shows a small reversal: the top ten’s share is back to 52%, and the largest five groups hold 37%, up from 34% in 2025, driven by Qilin and The Gentlemen.
How long do new groups last?
First seen in
New groups
Still posting in 2023
Still posting in 2024
Still posting in 2025
Still posting in 2026*
2022
34
19 (56%)
13 (38%)
8 (24%)
6 (18%)
2023
39
n/a
24 (62%)
17 (44%)
11 (28%)
2024
56
n/a
n/a
32 (57%)
17 (30%)
2025
78
n/a
n/a
n/a
39 (50%)
Groups whose first RansomLook post falls in the year and that posted that year, and how many of them posted at least one victim in each later year. *2026 is January to September. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
Between half and three in five of each year’s new groups post again the following year: 19 of 34 from 2022, 24 of 39 from 2023, 32 of 56 from 2024, and 39 of 78 from 2025. Few last long. Only 6 of the 34 groups that appeared in 2022 have posted in 2026. A group going quiet does not mean its members stopped; many reappear under a new name.
Group dossiers: the top 10
#1
Qilin
#1 in 2025
1,023victims, Jan to Sep 2026
+84%vs 556 same months 2025
12.8%share of all 2026 victims
First seen
2022-10-08
Latest post
2026-10-12
Busiest month
Aug 2026 (165)
Months posting
9 of 9 in 2026
Biggest day
2026-08-16 (19 victims)
Years tracked
4.0 years
CISA
No #StopRansomware advisory as of October 2026.
FBI
FBI IC3 2025: #2 most reported variant (Qilin).
#2
The Gentlemen
#39 in 2025
892victims, Jan to Sep 2026
newvs 38 same months 2025 (first weeks)
11.1%share of all 2026 victims
First seen
2025-09-09
Latest post
2026-10-11
Busiest month
Aug 2026 (162)
Months posting
9 of 9 in 2026
Biggest day
2026-08-22 (47 victims)
Years tracked
1.1 years
CISA
No #StopRansomware advisory as of October 2026.
FBI
Not in FBI IC3’s 2025 top 10.
#3
Akira
#3 in 2025
390victims, Jan to Sep 2026
-6%vs 413 same months 2025
4.9%share of all 2026 victims
First seen
2023-04-29
Latest post
2026-10-12
Busiest month
May 2026 (78)
Months posting
9 of 9 in 2026
Biggest day
2026-05-07 (46 victims)
Years tracked
3.5 years
CISA
AA24-109A: #StopRansomware: Akira Ransomware (updated November 2025)
FBI
FBI IC3 2025: #1 most reported variant (Akira).
#4
INC Ransom
#6 in 2025
360victims, Jan to Sep 2026
+45%vs 249 same months 2025
4.5%share of all 2026 victims
First seen
2023-08-09
Latest post
2026-10-12
Busiest month
Mar 2026 (56)
Months posting
9 of 9 in 2026
Biggest day
2026-03-04 (13 victims)
Years tracked
3.2 years
CISA
No #StopRansomware advisory as of October 2026.
FBI
FBI IC3 2025: #3 most reported variant (INC./Lynx/Sinobi).
#5
DragonForce
#10 in 2025
323victims, Jan to Sep 2026
+123%vs 145 same months 2025
4.0%share of all 2026 victims
First seen
2023-12-13
Latest post
2026-10-12
Busiest month
Apr 2026 (65)
Months posting
9 of 9 in 2026
Biggest day
2026-05-27 (23 victims)
Years tracked
2.8 years
CISA
No #StopRansomware advisory. CISA’s June 2025 SimpleHelp RMM advisory (AA25-163A) cites Sophos research on DragonForce actors attacking an MSP and its customers.
FBI
FBI IC3 2025: #8 most reported variant (Dragonforce).
#6
LockBit 5
no posts Jan to Sep 2025
258victims, Jan to Sep 2026
newvs 0 same months 2025
3.2%share of all 2026 victims
First seen
2025-12-05
Latest post
2026-10-10
Busiest month
Mar 2026 (53)
Months posting
9 of 9 in 2026
Biggest day
2026-02-20 (34 victims)
Years tracked
0.9 years
CISA
No advisory under this name. CISA’s LockBit 3.0 advisory is AA23-075A.
FBI
FBI IC3 2025: #7 most reported variant (Lockbit).
#7
NightSpire
#13 in 2025
250victims, Jan to Sep 2026
+131%vs 108 same months 2025
3.1%share of all 2026 victims
First seen
2025-03-12
Latest post
2026-10-12
Busiest month
Mar 2026 (65)
Months posting
9 of 9 in 2026
Biggest day
2026-02-16 (36 victims)
Years tracked
1.6 years
CISA
No #StopRansomware advisory as of October 2026.
FBI
Not in FBI IC3’s 2025 top 10.
#8
Cl0p
#2 in 2025
245victims, Jan to Sep 2026
-41%vs 418 same months 2025
3.1%share of all 2026 victims
First seen
2021-09-09
Latest post
2026-09-23
Busiest month
Jan 2026 (91)
Months posting
7 of 9 in 2026
Biggest day
2026-08-05 (42 victims)
Years tracked
5.1 years
CISA
AA23-158A: #StopRansomware: CL0P Ransomware Gang Exploits MOVEit Vulnerability
FBI
Not in FBI IC3’s 2025 top 10.
#9
Play
#4 in 2025
209victims, Jan to Sep 2026
-33%vs 310 same months 2025
2.6%share of all 2026 victims
First seen
2022-11-26
Latest post
2026-10-04
Busiest month
Mar 2026 (46)
Months posting
9 of 9 in 2026
Biggest day
2026-03-30 (10 victims)
Years tracked
3.9 years
CISA
AA23-352A: #StopRansomware: Play Ransomware (updated June 2025)
FBI
FBI IC3 2025: #5 most reported variant (Play).
#10
Coinbase Cartel
#76 in 2025
177victims, Jan to Sep 2026
newvs 14 same months 2025 (first weeks)
2.2%share of all 2026 victims
First seen
2025-09-15
Latest post
2026-08-31
Busiest month
Aug 2026 (49)
Months posting
8 of 9 in 2026
Biggest day
2026-04-15 (17 victims)
Years tracked
1.1 years
CISA
No #StopRansomware advisory as of October 2026.
FBI
Not in FBI IC3’s 2025 top 10.
“Latest post” and years tracked are as of 2026-10-13, counted from the first post RansomLook holds for the name (RansomLook began in 2021, so older groups are understated). CISA links verified on cisa.gov in October 2026. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
CISA and its partners have published #StopRansomware advisories for only three of these ten groups under their current names. None of the top two has one. The advisories that do exist are still useful for defense: we coded every one by the way attackers got in, in our analysis of ransomware initial access vectors.
The FBI’s list vs the leak sites
The FBI ranks groups by complaints filed with its Internet Crime Complaint Center, not by leak-site posts. Its 2025 report names ten variants that together account for 56.8% of ransomware complaints and identifies 63 new variants during the year. Seven of the FBI’s ten are also in the 2025 leak-site top 10. The exception that stands out is BianLian.
FBI IC3 rank, 2025
Variant
Leak-site victims, 2025
Leak-site rank, 2025
Leak-site victims, 2026 (Jan to Sep)
1
Akira
640
#2
390
2
Qilin
1,028
#1
1,023
3
INC./Lynx/Sinobi
813
#6
507
4
BianLian
32
#56
0
5
Play
385
#4
209
6
Ransomhub
236
#9
0
7
Lockbit
157
#18
258
8
Dragonforce
222
#10
323
9
SAFEPAY
380
#5
159
10
Medusa
158
#14
28
IC3 rank from the FBI 2025 IC3 Annual Report. Leak-site counts from RansomLook; for combined entries the counts are summed and the best-ranked member is shown.
BianLian is fourth on the FBI’s complaint list but posted only 32 victims on its leak site in 2025. That gap is a reminder that leak sites capture groups that publish, not every group that attacks. Total complaints are covered in our five-year trend of ransomware reported to the FBI.
Full leaderboard
Rank
Group
Jan to Sep 2026
Jan to Sep 2025
Change
Full year 2025
Share of 2026
First seen
1
Qilin
1,023
556
+84%
1,028
12.8%
2022-10
2
The Gentlemen
892
38
new
78
11.1%
2025-09
3
Akira
390
413
-6%
640
4.9%
2023-04
4
INC Ransom
360
249
+45%
369
4.5%
2023-08
5
DragonForce
323
145
+123%
222
4.0%
2023-12
6
LockBit 5
258
0
new
110
3.2%
2025-12
7
NightSpire
250
108
+131%
137
3.1%
2025-03
8
Cl0p
245
418
-41%
543
3.1%
2021-09
9
Play
209
310
-33%
385
2.6%
2022-11
10
Coinbase Cartel
177
14
new
63
2.2%
2025-09
11
SafePay
159
283
-44%
380
2.0%
2024-11
12
Krybit
155
0
new
0
1.9%
2026-04
13
Everest
140
82
+71%
139
1.7%
2021-09
14
ShinyHunters
131
0
new
0
1.6%
2026-01
15
DeadLock
103
0
new
0
1.3%
2026-06
16
Nova
95
46
+107%
87
1.2%
2025-04
17
Genesis
91
0
new
24
1.1%
2025-10
18
Sinobi
86
34
new
173
1.1%
2025-07
19
PayoutsKing
82
18
new
39
1.0%
2025-07
20
LeakedData
79
88
-10%
90
1.0%
2024-12
21
DireWolf
78
40
+95%
59
1.0%
2025-05
22
Storm
78
0
new
0
1.0%
2026-08
23
Payload
75
0
new
0
0.9%
2026-02
24
Anubis
72
16
+350%
41
0.9%
2025-02
25
Pear
72
36
new
51
0.9%
2025-08
Deduplicated leak-site victims by group. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
As an independent check on the rankings, we applied the same counting rule to ransomwatch, an open tracker archived in 2025. It names the same leading group as RansomLook in both years it fully covers (LockBit 3.0 in 2023 and RansomHub in 2024), and 8 and 9 of its top ten groups match RansomLook’s top ten for those years.
What this means for MSPs
Plan for the top five, not one headline group. Qilin, The Gentlemen, Akira, INC Ransom, and DragonForce posted 37% of 2026 victims. Their CISA coverage is uneven, so build detections from the advisories that exist and from the techniques they share.
Remote access tools are a known route to MSP clients. CISA’s June 2025 advisory on unpatched SimpleHelp RMM describes ransomware actors reaching the customers of a software provider through the tool, and cites research tying DragonForce actors to an attack on an MSP. Keep RMM and remote support software patched and behind MFA.
Expect new names. With 84 groups first seen this year, blocklists keyed to group names age fast. Controls that stop the common entry points age much more slowly.
Frequently asked questions
What are the top 10 ransomware groups in 2026?
By victims posted on leak sites from January to September 2026: Qilin (1,023), The Gentlemen (892), Akira (390), INC Ransom (360), DragonForce (323), LockBit 5 (258), NightSpire (250), Cl0p (245), Play (209), Coinbase Cartel (177). Together they account for 52% of all posts.
What is the most active ransomware group?
Qilin. It posted 1,023 victims from January to September 2026, 13% of all leak-site posts and up from 556 in the same months of 2025. The FBI’s IC3 ranked Qilin the second most reported variant in 2025.
How many ransomware groups are there?
161 groups posted at least one victim on a leak site from January to September 2026, up from 124 in the same months of 2025. 84 of them were first seen in 2026. Many are small: 46 posted five victims or fewer.
Who are The Gentlemen ransomware group?
The Gentlemen first appeared on RansomLook on 2025-09-09. They posted 892 victims from January to September 2026, second only to Qilin, and posted in every month of 2026 so far, peaking at 162 victims in August. There is no CISA #StopRansomware advisory on the group as of October 2026.
Which ransomware groups have CISA advisories?
Of the ten most active groups in 2026, three have a #StopRansomware advisory under the same name: Akira (AA24-109A), Cl0p (AA23-158A), and Play (AA23-352A). CISA’s LockBit 3.0 advisory (AA23-075A) predates the LockBit 5 leak site. Qilin, The Gentlemen, INC Ransom, DragonForce, NightSpire, and Coinbase Cartel have none.
Which ransomware groups did the FBI see most in 2025?
The FBI’s 2025 IC3 report lists Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay, and Medusa as the most reported variants, together 56.8% of ransomware complaints. BianLian ranks fourth there but posted only 32 victims on its leak site in 2025.
Sources. RansomLook public API, every leak-site post January 2021 to October 2026, plus its group first-seen endpoint; RansomLook content is licensed under CC BY 4.0, and we deduplicated and aggregated it. ransomwatch posts.json (archived open project, Unlicense) as a ranking cross-check for 2023 and 2024. CISA #StopRansomware official alerts page and every advisory linked from it, each fetched to confirm it resolves on cisa.gov. FBI 2025 IC3 Annual Report for the most reported variants. Retrieved 2026-10-13.
Counting rule. A victim is a post on a group’s leak site. Names were trimmed, whitespace-collapsed, and lowercased; the same name posted by the same group within 30 days counts once (521 RansomLook duplicates removed). Groups are counted by leak-site name, so rebrands and relaunches (for example LockBit 3.0 and LockBit 5) are separate rows.
Periods. 2026 figures are January to September and are compared with the same months of 2025. “Active” means at least one post in the period. “New” means RansomLook’s earliest post for that name falls in the year.
Limitations. Leak sites are a lower bound: victims who pay are rarely posted, some groups never run a leak site, and some claims are false or recycled. Post dates trail attack dates. RansomLook does not classify victims by country or industry, so this report does not break groups down that way.
Not advice. This is an analysis of public claims data, not a statement that any named organization was breached.
Cite as:The Uptime Report. "Ransomware Groups 2026: Qilin Leads, and a Gang First Seen Last September Is Now Second." October 2026. https://theuptimereport.com/ransomware-groups-2026/
Ransomware Statistics 2026: Leak-Site Victim Posts Are Up a Third, With a Record August
These ransomware statistics count the victims that ransomware groups name on their own leak sites. From January to September 2026, groups posted 8,009 victims, up 33% on the same months of 2025, and August set a monthly record of 1,222. 161 groups posted at least once, and groups less than a year old posted 47% of victims.
8,009leak-site victim posts, Jan to Sep 2026
+33%vs 6,003 in Jan to Sep 2025
1,222posts in August 2026, the busiest month on record
47%of 2026 victims posted by groups under 12 months old
Ransomware victims posted every month since 2021
RansomLook, deduplicated ransomwatch (archived, to December 2024, before it wound down)
Victims named on ransomware and data-extortion leak sites per month, by the date RansomLook first saw the post, January 2021 to September 2026. October 2026 is incomplete and excluded. Shaded period: trackers were still loading older posts in bulk, so counts there reflect when a site was added, not when victims were posted. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
The series shows a step up in late 2024, a jump in 2025, and a higher plateau in 2026 that peaked in August at 1,222, ahead of the previous high of 1,025 in October 2025. Some spikes are mass postings by a single group, such as Cl0p naming 235 victims on 24 February 2025 and KillSec naming 169 on 10 October 2025. The August 2026 record is different: it was spread across Qilin (165), The Gentlemen (162), Cl0p (87).
As a check, we ran the same counting rule over ransomwatch, an independent open tracker that stopped updating in mid-2025. For 2023 and 2024 it recorded 9,901 victims against 11,408 in RansomLook, 13% fewer, and its monthly counts moved with RansomLook’s (correlation 0.72).
2026 vs 2025, month by month
Month
2025
2026
Change
2026: share by groups under 12 months old
January
695
788
+13%
43%
February
999
826
-17%
46%
March
805
930
+16%
40%
April
672
832
+24%
54%
May
501
763
+52%
40%
June
520
840
+62%
54%
July
620
843
+36%
47%
August
542
1,222
+125%
55%
September
649
965
+49%
44%
January to September
6,003
8,009
+33%
47%
Deduplicated victim posts by month first seen: the same victim name posted by the same group within 30 days is counted once. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
Every month of 2026 so far is above the same month of 2025 except February, the month of the 2025 Cl0p dump. Who is doing the posting is a separate story: two groups, Qilin and The Gentlemen, account for 24% of 2026 victims. We rank every group and profile the leaders in our companion report on the most active ransomware groups of 2026.
New groups post nearly half of all victims
groups less than 12 months old at the time of the post older groups
Age is measured from the first post RansomLook holds for each leak-site name. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
In 2026, groups that had been posting for less than a year accounted for 3,780 of 8,009 victims (47%). That share has been steady at roughly half every year since 2023 (51% in 2023, 49% in 2024, 47% in 2025), so the growth in 2026 came from new and established groups at about the same rate: young groups added 952 of the 2,006 additional victims. Some “new” names are rebrands of older operations; the data counts leak-site names, not people.
Which ransomware groups are driving the numbers
Qilin1,023 in 2026 YTD, peak 190 in a month
The Gentlemen892 in 2026 YTD, peak 162 in a month
Akira390 in 2026 YTD, peak 87 in a month
INC Ransom360 in 2026 YTD, peak 56 in a month
DragonForce323 in 2026 YTD, peak 65 in a month
LockBit 5258 in 2026 YTD, peak 110 in a month
Small multiples: monthly leak-site victims for the six most active groups of 2026, since January 2025, each on its own scale. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
The six largest groups show very different shapes. The Gentlemen and LockBit 5 barely existed at the start of the window. Qilin has been large throughout and climbed further. Akira has held a steady pace rather than growing. That mix is why the totals keep rising even as individual groups come and go.
When ransomware groups post
Average victim posts per calendar day by weekday, January to September 2026; black ticks show 2025. Day is the UTC date RansomLook first saw the post; it scrapes leak sites several times a day. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
Leak-site posting follows a working week. In 2026, RansomLook first saw an average of 34 victims per weekday against 18 per Saturday or Sunday, and Monday was the busiest day at 39.5. The pattern held in 2025. For defenders, this says nothing about when intrusions happen; it shows when groups publish, which is when a victim’s name, and often its data, becomes public.
Why leak-site numbers are a floor
A leak-site post is a claim by a criminal group, typically made when a victim has not paid. Victims who pay before the deadline, and attacks that are never claimed, do not appear. Some posts are false or recycled. Treat every count on this page as a lower bound of attacks, not a census.
Post dates also trail attack dates, by an amount these data cannot measure: RansomLook records when a post appeared, not when the intrusion happened. Official counts are smaller still because they rely on victims coming forward. The FBI’s Internet Crime Complaint Center logged 3,611 ransomware complaints in 2025, up from 3,156 in 2024, a trend we track in our five-year analysis of ransomware reported to the FBI. IC3 also identified 63 new ransomware variants in 2025. CISA and the FBI publish #StopRansomware advisories on individual groups; we coded every one by entry technique in our report on ransomware initial access vectors.
Ransomware statistics by year
Year
Leak-site victims (RansomLook)
ransomwatch (cross-check)
Groups posting
Share by groups under 12 months old
FBI IC3 ransomware complaints
2021
2,315
1,783
46
n/a
n/a
2022
4,169
2,865
61
n/a
n/a
2023
5,391
4,748
71
51%
2,825
2024
6,017
5,153
102
49%
3,156
2025
8,795
n/a
140
47%
3,611
2026*
8,009
n/a
161
47%
n/a
*2026 is January to September; the young-group share uses January to September for every year. 2021 and 2022 include bulk backfills of older posts. ransomwatch stopped updating in mid-2025. IC3 complaints from the FBI 2025 IC3 Annual Report. Source: RansomLook, licensed CC BY 4.0; deduplicated and aggregated by The Uptime Report.
What this means for MSPs
The like-for-like growth is clear, so plan for more incidents among clients, not fewer. Three points from the data are specific enough to act on:
Name-based threat tracking ages fast. Groups less than a year old post about half of all victims, year after year. Controls aimed at common entry points, such as patched edge devices, MFA on remote access, and tested offline backups, outlast any list of group names.
Expect publication on weekdays. If a client is in negotiations or has refused to pay, a leak-site post is most likely to land on a weekday. Have the communications and legal contacts ready before the deadline, not after.
Do not wait for a leak-site post. By the time a victim is named, its data has already left the network. Monitoring trackers for client and supplier names is useful for third-party risk, but it is a lagging indicator, not detection.
Frequently asked questions
How many ransomware attacks were there in 2026?
Ransomware groups posted 8,009 victims on their leak sites from January to September 2026, according to RansomLook data, up 33% on the same months of 2025. This is a lower bound of attacks: victims who pay quickly are usually never posted.
How many ransomware attacks were there in 2025?
RansomLook recorded 8,795 leak-site victim posts in 2025 after removing duplicates, a record at the time and up 46% on 6,017 in 2024.
Is ransomware increasing?
Yes, on leak-site data. Posts from January to September 2026 are up 33% on 2025, August 2026 set a monthly record of 1,222, and the number of groups posting rose from 124 to 161 over the same months. FBI complaints also rose, from 3,156 in 2024 to 3,611 in 2025.
Which ransomware groups are most active in 2026?
By leak-site victims from January to September 2026: Qilin (1,023), The Gentlemen (892), Akira (390), INC Ransom (360), DragonForce (323). The top two posted 24% of all victims.
What day of the week do ransomware groups post victims?
Weekdays, mostly. In 2026, RansomLook first saw an average of 34 victim posts per weekday against 18 per weekend day. Monday is the busiest day, at 39.5 posts on average.
How many ransomware complaints did the FBI receive in 2025?
The FBI’s Internet Crime Complaint Center received 3,611 ransomware complaints in 2025 and identified 63 new ransomware variants, according to its 2025 annual report. That is fewer than leak-site posts because it counts only victims who report to IC3.
Source.RansomLook public API (/api/posts/{year}/{month} and /api/group-first-seen), every post January 2021 to October 2026, retrieved 2026-10-13. RansomLook content is licensed under CC BY 4.0; we deduplicated and aggregated it, and the counts on this page are our own. Cross-checks: ransomwatch posts.json (archived open project, released under the Unlicense) and the FBI 2025 IC3 Annual Report.
Counting rule. A victim is a post on a ransomware or data-extortion group’s leak site. Victim names were trimmed, whitespace-collapsed, and lowercased; the same name posted by the same group within 30 days counts once. This removed 521 of 35,619 posts. Re-posts by the same group more than 30 days apart are kept and flagged (11 in 2026 so far). We also flagged 45 2026 posts where a different group had posted the same victim name within the previous 90 days, a sign of re-extortion, affiliates switching brands, or recycled claims; each is counted once per group. Partly masked victim names appear in 41 posts from 2026; these are counted as posted.
Dates and ages. Months and weekdays use the UTC date RansomLook first saw each post. Like-for-like comparisons use January to September in both years; October 2026 was incomplete at retrieval and is excluded. A group’s age is the time since the earliest post RansomLook holds for that leak-site name.
Coverage and limitations. Leak sites undercount attacks (paying victims are rarely posted) and include some false, recycled, or exaggerated claims. Groups that rebrand appear under new names. RansomLook does not classify victims by country or industry, so this report does not break them down that way. Before 2023, trackers were still adding older leak sites in bulk.
Not advice. This is an analysis of public claims data, not a statement that any named organization was breached.
Cite as:The Uptime Report. "Ransomware Statistics 2026: Leak-Site Victim Posts Are Up a Third, With a Record August." October 2026. https://theuptimereport.com/ransomware-statistics-2026/
Malicious npm Packages: 63% of 222,159 Reports Were One Token-Farming Flood, While Worms Hit the Top 1,000
We counted every record of malicious npm packages in the OpenSSF database: 222,159 through 13 October 2026, 93% of all ecosystems. But 63% came from one tea.xyz token-farming flood in November 2025, and 17% from two bulk uploads with no detail. The dangerous part is small: 19 records hit top-1,000 packages like chalk, axios, and keyv.
222,159malicious npm records, 2021 to 13 Oct 2026
63.3%tea.xyz token farming, filed 9 to 13 Nov 2025
19records naming a top-1,000 npm package
0.4%of non-spam names are lookalikes of a top-1,000 package
6.9xnpm vs PyPI, even with token farming removed
Every malicious npm report, day by day
Each square is one day. The color is the number of npm records the OpenSSF database published that day, from the first records in 2021 to our snapshot on 13 October 2026. Hover a square for the exact count.
01 to 45 to 1920 to 4950 to 199200 to 9991,000+
Records per day by OSV “published” date, npm only. Totals under each year. Outlined squares are after our retrieval date. Source: OpenSSF malicious-packages repository, our count.
The calendar is mostly light and mid blue: on a typical day in 2026 the database adds a few dozen npm records. Only 9 days crossed 1,000 records, and each one has an explanation in the records themselves. The largest was 11 November 2025, with 76,854. The four red days from 10 to 13 November 2025 are the tea.xyz token-farming campaign that Amazon Inspector reported. 14 August (34,202) and 5 September 2025 (4,726) are bulk uploads published at a single second. 20 June 2022 (4,691) is GitHub’s malware advisory feed. On 25 June 2024 (2,283), ReversingLabs filed records whose names advertise free movies, game currency, and gift-card generators. 5 August 2026 (1,352), the day after the keyv worm, is mostly Amazon Inspector records describing install-time droppers.
What the 222,159 records actually are
Token farming: record text names the tea.xyz campaign or tea protocol. Bulk uploads: non-token-farming records sharing one publish timestamp with 500 or more others. Everything else is counted as individually described.
Headline counts of malicious npm packages are dominated by spam. 140,728 records (63.3%) describe packages built to farm tea.xyz rewards: no functional code, auto-publishing scripts, and randomized names. Amazon Inspector, which filed them, says it identified over 150,000 such packages in an investigation that ran from 8 to 12 November 2025 and submitted them to the OpenSSF repository. Another 38,805 records (17.5%) arrived in two bulk uploads, on 14 August and 5 September 2025, whose records say only that the package “was found to contain malicious code.”
That leaves 42,626 individually described records over five years. This is the series to watch for real attack activity, and it is the one we chart next.
Malicious npm packages per month
2022 to 20252026October 2026, 13 days only
Individually described npm records per month (token farming and the two bulk uploads removed), by OSV published date.
The busiest month in this series was June 2022, with 4,943 records, 4,691 of them from GitHub’s malware advisory feed on a single day, 20 June. In 2026 the peak was August, with 4,078, the month of the keyv worm. From January to September 2026 the database published 12,417 individually described npm records, against 7,858 in the same months of 2025, a change of +58%. Counting every record, the comparison runs the other way (12,417 against 46,663) because the 2025 figure includes both bulk uploads. That gap is why raw totals are a poor measure of attack activity.
We then tested whether the 2026 rise in individually described records reflects more attacks or more reporting. It is mostly one reporter. Records crediting Amazon Inspector went from 2,699 to 9,626 in those nine months, while records crediting anyone else fell from 5,159 to 2,791. The data shows more reporting by one contributor; it cannot show whether more malicious npm packages are being published.
Publish dates measure when a report reached the database, not when the package went live on npm. A surge in a month can mean more attacks or more reporting, and the data cannot separate the two.
npm against PyPI and other ecosystems
All malicious records in the OpenSSF database by ecosystem directory, snapshot of 13 October 2026.
npm accounts for 92.9% of the 239,109 malicious package records in the database. PyPI is a distant second with 11,798, then RubyGems with 4,304 and NuGet with 782. Removing the token-farming flood does not change the order: npm still has 81,431 records, 6.9 times PyPI. The year rows show one other jump worth watching: RubyGems went from 129 records in 2025 to 3,368 so far in 2026.
Year
npm
PyPI
RubyGems
NuGet
Other
npm: token farming
npm: bulk uploads
npm: individually described
2022
7,424
20
0
0
1
0
0
7,424
2023
2,291
6,467
16
0
1
0
0
2,291
2024
8,317
2,645
791
738
0
0
0
8,317
2025
191,307
1,245
129
22
27
140,728
38,805
11,774
2026*
12,771
1,421
3,368
22
35
0
0
12,771
*2026 is 1 January to 13 October. 46 records with no published date and 5 from 2021 are excluded from the year rows.
The largest incident waves
We matched waves to records using text in the records themselves (for example, every record that names Sha1-Hulud) or a date window, then checked each against the primary source. Counts are OpenSSF records, which can be lower than the number of packages a vendor or registry reports.
Date
Wave and how we matched it
Records
What the primary source says
Primary source
10 to 13 Nov 2025
tea.xyz token-farming flood Record text names the tea.xyz token reward campaign
140,728
Amazon Inspector says it identified over 150,000 packages tied to the campaign, investigated 8 to 12 November, and submitted them to OpenSSF.
chalk and debug maintainer phishing All npm records published that day
20
The debug advisory says the publishing account was taken over after a phishing attack on 8 September and the malware redirected cryptocurrency transactions.
The five worm waves (Shai-Hulud, Sha1-Hulud, TanStack, @antv, and keyv) add up to 1,798 records, less than 1% of the database. Their reach is the opposite of their count: the keyv wave alone hit keyv, flat-cache, and file-entry-cache, which together had 2.2 billion downloads last month. For Shai-Hulud, the database has 203 records naming the worm, while GitHub says it removed more than 500 compromised packages: the OpenSSF count is a floor, not a census.
Hijacked packages in the npm top 1,000
We checked every malicious record against the 1,000 most-downloaded npm packages (ecosyste.ms ranking by last-month downloads). 19 records name one exactly. These are not lookalikes: each record lists specific malicious versions of a legitimate, heavily used package. Together the 19 packages had 25.4 billion downloads in the last month.
Download rank and monthly downloads from ecosyste.ms, retrieved 13 October 2026. Each record lists only the malicious versions; other versions of these packages are not affected.
12 of the 19 come from a single day, 8 September 2025, when one maintainer’s account was phished. The keyv case shows why build provenance alone does not settle trust: the record states that the poisoned versions carried a valid, signed provenance attestation, because attackers pushed code to the source repository and let the normal release workflow publish it.
Typosquats are a small share
To test the typosquatting story, we compared each package name to the top 1,000 npm names. A name counts as a lookalike if it is one edit away from a popular name of four or more characters, or two edits away from one of seven or more characters. Exact matches (the hijacks above) are excluded.
Only 332 of 81,430 non-token-farming names pass (0.4%): 96 at one edit and 236 at two. None of the 140,728 token-farming names do (0 matches). The most imitated targets are express (19 lookalikes), commander (13), and lodash (10).
Two other naming signals are larger. 19.3% of non-token-farming records are scoped names like @org/package (7.7% of all records). And of the 24,096 non-token-farming records that list explicit versions, 3,838 (15.9%) include a major version of 90 or higher, a pattern used to win version resolution in dependency confusion.
Amazon Inspector is credited on 88% of all npm records. With token farming removed, the field is wider:
Credited finder
Records excl. token farming
Share
All npm records
Amazon Inspector
54,996
67.5%
195,724
ReversingLabs
10,023
12.3%
10,024
OpenSSF: Package Analysis
5,287
6.5%
5,288
SafeDep
1,454
1.8%
1,454
Aikido Security
444
0.5%
444
Socket Threat Research Team
444
0.5%
444
GitHax: Software Supply Chain Threat Intelligence
194
0.2%
194
Checkmarx
142
0.2%
142
OX Security
103
0.1%
103
Stacklok: trustypkg.dev
65
0.1%
65
A record can credit more than one finder, so shares can sum past 100%. 15,483 non-token-farming records credit no finder; 15,438 of them list GitHub’s malware advisory feed (ghsa-malware) as a source.
This concentration matters for anyone reading trend lines. A new detection rule from one large contributor can move a month’s total by tens of thousands, as August and November 2025 show. The same caution applies when reading the record pace of CVE publication in 2026: a count of reports is not a count of attacks.
What this means for MSPs
Do not let installs run code by default. CISA’s April 2026 axios alert recommends ignore-scripts=true in .npmrc. GitHub says Shai-Hulud spread through malicious post-install scripts, and the OpenSSF records say the @antv and keyv waves ran through preinstall hooks.
Add a release-age delay. The same alert recommends min-release-age=7 so npm only installs versions at least seven days old. TanStack says its malicious versions were spotted 20 to 26 minutes after publication, and the debug advisory says the bad release was removed the same day, so a short delay would have skipped both.
Commit lockfiles and install with npm ci. OpenSSF’s npm guide recommends lockfiles because they pin dependencies by cryptographic hash, and npm ci treats them as read-only. CISA’s Shai-Hulud alert asked teams to check lockfiles for affected versions and pin to releases from before 16 September 2025.
Treat provenance as necessary, not sufficient. Provenance proves which pipeline built a package, not that the source was clean. The keyv versions shipped with valid provenance.
Claim your scopes and allowlist registries. OpenSSF recommends registering your organization’s scope on the public registry and binding it to your private registry, which blocks dependency confusion.
Monitor the feed, not the headlines. The OpenSSF records are free in OSV format; matching client lockfiles against them catches the hijacks that matter. When a wave hits, rotate developer and CI credentials, as CISA advised for both Shai-Hulud and axios. Only 7 of the 222,159 npm records carry a CVE alias, and the CISA Known Exploited Vulnerabilities catalog lists only CVEs, so do not wait for KEV to flag a package compromise.
Frequently asked questions
How many malicious npm packages are there?
The OpenSSF malicious-packages database held 222,159 npm records on 13 October 2026, covering 222,158 unique package names. That is 92.9% of all 239,109 malicious package records across every ecosystem in the database. OSV.dev’s npm export of the same day lists 222,158 active MAL records; the one-record gap is a record published after the export.
Are npm packages safe?
Most reported malicious packages are spam: 63% are tea.xyz token farming. But 19 records name packages in the 1,000 most-downloaded on npm, including chalk, debug, axios, and keyv. Those hijacks, not obscure lookalikes, are where real exposure comes from.
Is there a recent issue with npm?
The latest large wave was the keyv and cacheable worm of 4 August 2026, with 444 OpenSSF records. The database added 855 npm records in September 2026 and 354 from 1 to 13 October.
Are most malicious npm packages typosquats?
No. Only 332 of 81,430 non-token-farming package names (0.4%) sit within one or two character edits of a top-1,000 npm package under our test. None of the 140,728 token-farming names did.
How does npm compare with PyPI for malicious packages?
npm has 222,159 records against 11,798 for PyPI. Even after removing token farming, npm has 81,431, or 6.9 times PyPI.
How do you protect against npm supply chain attacks?
CISA’s 2026 axios alert recommends setting ignore-scripts=true and min-release-age=7 in .npmrc, rotating developer credentials, and phishing-resistant MFA. OpenSSF’s npm guide adds committed lockfiles installed with npm ci and scoped names for private packages.
Source. OpenSSF malicious-packages repository (github.com/ossf/malicious-packages), main branch tarball downloaded 13 October 2026. We parsed every OSV record under osv/malicious/ (239,109 records across 11 ecosystem directories; 356 withdrawn records under osv/withdrawn/ excluded). Ecosystem is the directory name. Dates are the OSV “published” field (UTC).
Cross-check. OSV.dev’s npm export (all.zip, same day) holds 222,489 MAL- records, of which 331 are withdrawn, leaving 222,158. Our OpenSSF count is 222,159; the one-record difference is a record published after the OSV export.
Definitions. Token farming: summary or details text contains “tea.xyz” or “tea protocol”. Bulk upload: a non-token-farming npm record whose published timestamp is shared by 500 or more others (two timestamps qualify: 2025-08-14T18:52:04Z (34,166), 2025-09-05T17:10:25Z (4,639)). Individually described: all other npm records. Finder: names in each record’s “credits” field. Lookalike: Levenshtein distance 1 to a top-1,000 name of 4+ characters, or 2 to a name of 7+ characters, exact matches excluded, full package names compared. Top 1,000: ecosyste.ms npm registry packages sorted by last-month downloads, retrieved 13 October 2026. Hijacked top package: record name exactly equals a top-1,000 name.
Limitations. The database counts reports, not attacks, and reporting effort varies by contributor and over time. Published dates show when a record entered the database, not when the package appeared on npm. One record covers one package; a wave’s record count can differ from the package or version counts vendors publish. Text matching depends on what contributors wrote: some records carry only generic text. The lookalike test catches character-level typos, not combination names like “express-helper”.
Not advice. This is an analysis of public data, not a security assessment of any package or environment.
Cite as:The Uptime Report. "Malicious npm Packages: 63% of 222,159 Reports Were One Token-Farming Flood, While Worms Hit the Top 1,000." October 2026. https://theuptimereport.com/malicious-npm-packages-statistics/
Windows 11 Market Share Hits 71.5%, but Windows 10 Still Holds 27.8% a Year After Support Ended
Windows 11 market share reached 71.5% of Windows desktop page views worldwide in September 2026, according to StatCounter Global Stats. Windows 10, which lost support on October 14, 2025, still accounted for 27.8%, down from 41.7% in the month support ended. Windows 11 first passed Windows 10 worldwide in July 2025, 45 months after launch.
71.5%Windows 11 share of Windows desktop, September 2026
27.8%Windows 10 share now, vs 41.7% at end of support
21.2%of all desktop page views are still Windows 10
45 vs 30months to pass the predecessor: Windows 11 vs Windows 10
3large markets where Windows 10 is still the majority
We downloaded StatCounter’s monthly Windows version series for the world, six continents, and the 59 countries with the largest StatCounter samples, plus its desktop operating system series, and computed crossover months, holdout shares, and year-on-year change for each. We checked the direction against the Steam Hardware Survey, which counts machines rather than page views. One caution applies throughout: StatCounter measures page views on websites that run its tracker, not installed devices, so a heavily used PC counts more than an idle one.
The crossover: when Windows 11 passed Windows 10
Windows 11 Windows 10 Other Windows versions
Share of Windows desktop page views, worldwide, Oct 2021 to Sep 2026. StatCounter reports 0% for Windows 11 until January 2022. Source: StatCounter Global Stats, Windows version market share, desktop, monthly. Licensed CC BY-SA 3.0. Hover a month for values.
Windows 11 needed 45 months to pass Windows 10 worldwide. Windows 10 itself passed Windows 7 in January 2018, 30 months after its July 2015 launch, in the same StatCounter series. In June 2025, the month before the crossover, the two were within 0.8 points of each other (Windows 11 48.0%, Windows 10 48.8%). Windows 11 has led in every month since.
The decline of Windows 10 did not speed up after support ended. It lost 19.2 points in the 12 months before end of support (October 2024 to October 2025) and 13.9 points in the 11 months after it. Most of the post-deadline drop came in one step: between December 2025 and February 2026, Windows 10 fell from 44.7% to 26.4% worldwide, and 63 of the 66 markets in our download fell by more than 5 points over the same two months. A move that is simultaneous across nearly every country is consistent with holiday PC replacement or with a change in how page views are sampled or detected. The Steam survey, which counts machines, shows no matching step: Windows 10 was 29.2% of Steam’s Windows PCs in December 2025 and 29.4% in January 2026. Treat the size of StatCounter’s winter drop with caution.
Partial month. StatCounter’s October 2026 reading, a partial month when we retrieved the data on 2026-10-13, shows Windows 11 at 76.2% and Windows 10 at 23.2%. We use September 2026 as the latest complete month.
How the Windows 10 holdout compares with Windows 7
Windows 7 support ended on January 14, 2020. Lining up both operating systems on their end-of-support month shows how many users hang on. Windows 7 held 24.9% of Windows desktop page views in January 2020 and 18.0% 11 months later. Windows 10 held 41.7% in October 2025 and 27.8% 11 months later. In relative terms the two shed a similar fraction (28% for Windows 7, 33% for Windows 10), but Windows 10 started from a much larger base, so the holdout population is larger.
Windows 7 share (grey) aligned on January 2020; Windows 10 share (red) aligned on October 2025. Share of Windows desktop page views, worldwide. Source: StatCounter Global Stats, Windows version market share, desktop, monthly. Licensed CC BY-SA 3.0.
The same pattern holds in the United States: Windows 7 went from 16.6% to 10.0% in the 11 months after its deadline, while Windows 10 went from 32.0% to 18.9%.
Where Windows 10 is still the majority
Averaging July to September of each year smooths out single-month noise. In the third quarter of 2026, Windows 10 still had a majority of Windows desktop page views in Russia, Iran and Indonesia, and those three are the only countries of the 48 with stable samples where Windows 10 was still more common than Windows 11. Windows 7 is still visible in China at 4.8% of Windows page views. At the other end, the markets that have moved furthest are Sri Lanka, United Kingdom and United Arab Emirates, each at 19.4% Windows 10 or less.
Q3 2025, last full quarter before end of support Q3 2026
Windows 10 share of Windows desktop page views, July to September average. Countries whose monthly Windows 10 share swung by 20 points or more in a single month since January 2025 are left out of the chart and flagged in the table (11 countries: Pakistan, Hong Kong, Argentina, Vietnam, Bangladesh, Brazil, Colombia, Greece, Philippines, Switzerland and Ireland). Source: StatCounter Global Stats, Windows version market share, desktop, monthly. Licensed CC BY-SA 3.0.
The United States sits well below the world average at 21.4% in the quarter, and Windows is a smaller slice of US desktop traffic (64.5% in September 2026) than of the world’s (76.4%), because macOS takes more of the rest. That matters when converting shares: Windows 10 was about 12.3% of all US desktop page views in the third quarter, against 20.5% worldwide.
Every market in the download
Region
Win 10, Q3 2025
Win 10, Q3 2026
Change (pts)
Win 11, Q3 2026
Win 7, Q3 2026
Win 11 ahead since
Windows share of desktop
Win 10 share of all desktop
Worldwide
44.3%
29.3%
-15.0
69.7%
0.8%
Jul 2025
70.2%
20.5%
Asia
45.9%
37.6%
-8.3
61.0%
1.1%
Jan 2026
78.1%
29.4%
Africa
52.6%
28.9%
-23.8
70.5%
0.4%
Oct 2025
70.7%
20.3%
South America
37.4%
27.1%
-10.3
72.6%
0.3%
Aug 2025
73.8%
20.0%
Europe
51.1%
25.8%
-25.3
72.9%
1.0%
Sep 2025
73.4%
18.9%
North America
38.9%
21.7%
-17.2
77.5%
0.6%
Mar 2025
59.0%
12.7%
Oceania
39.4%
20.2%
-19.1
78.4%
1.3%
Feb 2025
63.5%
12.8%
Russia
70.7%
54.8%
-16.0
42.4%
1.9%
Not yet
86.4%
47.3%
Iran
65.0%
54.2%
-10.8
44.5%
1.1%
Not yet
91.0%
49.3%
Indonesia
66.5%
53.8%
-12.7
46.0%
0.1%
Not yet
84.0%
45.2%
Egypt
62.7%
46.7%
-16.0
52.2%
0.9%
Sep 2026
81.8%
38.1%
Pakistan volatile
70.6%
46.5%
-24.1
53.0%
0.4%
Apr 2026
73.5%
34.5%
Azerbaijan
49.5%
46.4%
-3.1
52.4%
1.0%
Aug 2026
78.6%
36.8%
China
51.9%
43.1%
-8.8
51.0%
4.8%
Jan 2026
86.3%
37.1%
Taiwan
56.0%
43.1%
-12.9
56.4%
0.3%
Feb 2026
81.8%
35.2%
India
57.2%
41.9%
-15.3
57.8%
0.2%
Jan 2026
79.0%
33.1%
Serbia
64.5%
41.8%
-22.7
57.4%
0.5%
Feb 2026
82.3%
34.3%
Peru
53.9%
40.9%
-13.0
58.9%
0.2%
Sep 2025
81.0%
33.1%
Bulgaria
65.2%
40.3%
-25.0
59.0%
0.5%
Jan 2026
83.6%
33.7%
Thailand
53.6%
39.9%
-13.7
59.9%
0.2%
Jan 2026
70.6%
28.1%
Nepal
53.1%
39.5%
-13.7
60.3%
0.1%
Jan 2026
85.0%
33.5%
Hungary
63.8%
38.6%
-25.2
60.3%
0.9%
Jan 2026
84.3%
32.5%
South Korea
54.9%
37.8%
-17.1
61.9%
0.2%
Jan 2026
89.5%
33.8%
Hong Kong volatile
20.4%
37.5%
+17.1
59.9%
2.5%
Jul 2025
74.1%
27.8%
Argentina volatile
53.0%
37.4%
-15.6
62.2%
0.3%
Sep 2025
76.9%
28.7%
Turkey
62.7%
36.1%
-26.7
63.5%
0.3%
Feb 2026
80.6%
29.0%
Ukraine
61.5%
34.6%
-26.9
63.6%
1.5%
Jan 2026
70.3%
24.3%
Nigeria
58.6%
30.9%
-27.7
68.6%
0.2%
Jan 2026
67.5%
20.9%
Romania
47.9%
30.1%
-17.8
69.6%
0.2%
Aug 2025
89.7%
26.9%
Portugal
46.5%
29.8%
-16.6
69.6%
0.5%
Mar 2025
79.2%
23.6%
Mexico
50.0%
29.1%
-20.9
70.6%
0.2%
Sep 2025
72.5%
21.1%
Spain
52.3%
29.0%
-23.3
68.3%
2.4%
Oct 2025
75.0%
21.7%
Vietnam volatile
19.7%
28.8%
+9.1
70.6%
0.5%
Jan 2026
70.6%
19.9%
Italy
52.3%
28.8%
-23.5
69.8%
1.3%
Sep 2025
73.4%
21.1%
Israel
51.1%
28.4%
-22.8
71.1%
0.3%
Sep 2025
72.6%
20.6%
Bangladesh volatile
56.5%
27.2%
-29.4
72.1%
0.6%
Apr 2026
70.4%
19.0%
Norway
40.9%
26.1%
-14.8
69.7%
3.5%
Jan 2025
71.7%
18.7%
Papua New Guinea
41.3%
26.0%
-15.3
73.9%
0.1%
Jan 2025
88.5%
23.0%
Czech Republic
53.5%
25.8%
-27.6
73.2%
0.7%
Jan 2026
84.2%
21.8%
Brazil volatile
32.4%
25.6%
-6.8
74.0%
0.3%
Aug 2025
74.2%
19.0%
Morocco
49.6%
25.4%
-24.2
74.2%
0.2%
Sep 2025
67.5%
17.1%
France
52.1%
25.3%
-26.9
74.1%
0.3%
Oct 2025
74.8%
18.9%
Singapore
54.6%
24.6%
-30.1
74.2%
1.1%
Oct 2025
68.2%
16.7%
Netherlands
44.5%
23.6%
-20.9
73.6%
2.4%
Mar 2025
64.5%
15.1%
Sweden
44.5%
23.2%
-21.3
76.1%
0.5%
May 2025
64.7%
15.0%
Poland
49.6%
23.1%
-26.5
75.9%
0.7%
Sep 2025
85.6%
19.8%
Chile
41.3%
23.0%
-18.3
76.9%
0.1%
Jan 2025
71.2%
16.3%
Colombia volatile
42.8%
22.0%
-20.7
77.8%
0.1%
Jul 2025
72.2%
15.9%
Germany
55.5%
22.0%
-33.5
76.3%
1.3%
Oct 2025
72.1%
15.8%
Greece volatile
75.5%
22.0%
-53.5
77.7%
0.1%
Jan 2026
85.1%
18.7%
New Zealand
40.7%
21.6%
-19.1
78.1%
0.2%
Feb 2025
65.9%
14.2%
Japan
44.2%
21.4%
-22.7
76.6%
1.6%
Apr 2025
76.6%
16.4%
United States
37.9%
21.4%
-16.4
77.8%
0.6%
Mar 2025
58.1%
12.3%
Kenya
52.1%
20.9%
-31.2
78.9%
0.1%
Sep 2025
66.7%
14.1%
Canada
43.4%
20.7%
-22.7
77.8%
1.3%
Mar 2025
61.3%
12.7%
Austria
50.0%
20.3%
-29.7
79.2%
0.3%
Sep 2025
76.2%
15.5%
Philippines volatile
65.2%
20.2%
-45.0
79.8%
0.0%
Jan 2026
78.1%
15.8%
Malaysia
64.8%
19.9%
-44.9
80.0%
0.1%
Jan 2026
79.5%
15.9%
Australia
39.0%
19.8%
-19.2
78.7%
1.5%
Feb 2025
63.2%
12.5%
South Africa
39.0%
19.6%
-19.4
80.0%
0.2%
Mar 2025
68.1%
13.3%
Belgium
41.1%
19.4%
-21.7
79.9%
0.5%
Feb 2025
72.5%
14.1%
United Arab Emirates
40.1%
19.4%
-20.7
80.5%
0.1%
Mar 2025
62.7%
12.0%
Switzerland volatile
50.2%
18.6%
-31.6
80.3%
0.8%
Sep 2025
65.8%
12.2%
United Kingdom
37.3%
16.4%
-20.9
83.2%
0.3%
Jan 2025
65.6%
10.7%
Ireland volatile
26.4%
15.2%
-11.3
84.7%
0.1%
Mar 2025
69.1%
10.5%
Sri Lanka
59.4%
11.7%
-47.7
88.1%
0.1%
Nov 2025
96.8%
11.3%
Shares of Windows desktop page views unless stated. “Win 11 ahead since” is the first month after which Windows 11 led Windows 10 in every month through Sep 2026. “Win 10 share of all desktop” multiplies the monthly Windows 10 share by Windows’ share of all desktop page views, averaged over the quarter. Source: StatCounter Global Stats, Windows version market share, desktop, monthly. Licensed CC BY-SA 3.0.
Cross-check: Steam’s gaming PCs
The Steam Hardware and Software Survey samples Steam users’ machines once each, so it measures devices, not page views, but only for a gaming population. It tells the same story with an earlier crossover. In the survey captures we retrieved, Windows 11 has led Windows 10 in every month since December 2024 (it trailed in September 2024, after briefly leading in August 2024). In September 2026, Windows 10 was 24.8% of Steam’s Windows machines, against 32.8% in October 2025.
Windows 10 share of Windows. Red: StatCounter page views, monthly. Navy dots: Steam Hardware Survey (Windows 10 64-bit divided by all Windows), for the months we could retrieve. Sources: StatCounter Global Stats; Steam Hardware and Software Survey, live page and Internet Archive captures.
Month
Steam: Win 11
Steam: Win 10
StatCounter: Win 11
StatCounter: Win 10
Sep 2024
49.2%
50.2%
33.4%
62.8%
Dec 2024
57.2%
44.1%
34.1%
62.7%
Jan 2025
55.4%
44.4%
36.6%
60.3%
Mar 2025
57.6%
42.2%
42.7%
54.2%
May 2025
61.1%
38.8%
43.2%
53.2%
Jun 2025
62.5%
37.3%
48.0%
48.8%
Jul 2025
62.9%
37.0%
53.5%
42.9%
Aug 2025
63.2%
36.7%
49.8%
46.2%
Sep 2025
66.1%
33.7%
52.9%
43.8%
Oct 2025
67.0%
32.8%
55.2%
41.7%
Nov 2025
69.2%
30.7%
53.7%
42.7%
Dec 2025
70.7%
29.2%
50.7%
44.7%
Jan 2026
70.5%
29.4%
62.4%
35.8%
Feb 2026
58.3%
41.7%
72.6%
26.4%
Mar 2026
72.4%
27.5%
67.1%
31.3%
Apr 2026
72.5%
27.4%
70.3%
28.5%
May 2026
74.3%
25.6%
71.8%
26.2%
Jun 2026
74.9%
25.0%
69.9%
28.2%
Jul 2026
75.0%
24.9%
68.9%
29.9%
Aug 2026
75.5%
24.4%
68.6%
30.1%
Sep 2026
75.1%
24.8%
71.5%
27.8%
All values are shares of Windows. Steam months are those available from the live survey page and Internet Archive captures at retrieval. Steam’s February 2026 reading (Windows 10 at 41.7%) is out of line with the months on either side.
Steam’s Windows 10 share fell by 8.0 points from October 2025 to September 2026, compared with 13.9 points in StatCounter over the same months. Both sources put Windows 10 at roughly a quarter of Windows usage (24.8% on Steam, 27.8% in StatCounter) 11 months after the deadline.
The support calendar
End of support is not one date. Windows 10 LTSC editions run years longer, and Windows 11 versions have their own deadlines: Windows 11 24H2 Home and Pro reach end of updates on October 13, 2026, so a fully migrated fleet can still be out of date. The same Patch Tuesday cadence we track in our Patch Tuesday statistics stops reaching any version past its date.
Edition and version
Start
End of updates
Note
Windows 10 Home and Pro (22H2)
Jul 29, 2015
Oct 14, 2025
Ended. Consumer ESU to Oct 12, 2027
Windows 10 Enterprise and Education (22H2)
Jul 29, 2015
Oct 14, 2025
Ended. Commercial ESU up to 3 years
Windows 10 Enterprise LTSC 2019
Nov 13, 2018
Jan 9, 2029
Extended support
Windows 10 Enterprise LTSC 2021
Nov 16, 2021
Jan 12, 2027
Mainstream end
Windows 11 23H2, Enterprise and Education
Oct 31, 2023
Nov 10, 2026
Home and Pro ended Nov 11, 2025
Windows 11 24H2, Home and Pro
Oct 1, 2024
Oct 13, 2026
Enterprise to Oct 12, 2027
Windows 11 25H2, Home and Pro
Sep 30, 2025
Oct 12, 2027
Enterprise to Oct 10, 2028
Windows 11 26H2, Home and Pro
Sep 29, 2026
Oct 10, 2028
Enterprise to Oct 9, 2029
Source: Microsoft Lifecycle pages and Windows 11 release information. End dates are the last day of updates as Microsoft states them; Lifecycle pages show the cutoff as early the next morning. LTSC 2021 lists only a mainstream end date.
What this means for MSPs
ESU year two is about to bill. Microsoft sells commercial Extended Security Updates at $61 per device for year one, and the price doubles each year for up to three years. Year one started in November 2025, and ESU is cumulative: a client that joins in year two pays for year one as well. Per device, that is $183 to cover years one and two and $427 for all three.
$61Year one per device (from November 2025). $45 with Microsoft’s Intune or Windows Autopatch offer
$183Cumulative cost to be covered in year two ($61 + $122)
$427Cumulative cost through year three ($61 + $122 + $244)
Home and small-office machines have more runway. The consumer ESU program now runs to October 12, 2027. Enrollment is free for PCs that sync settings to a Microsoft account, or costs 1,000 Microsoft Rewards points or a one-time $30, and one license covers up to 10 devices. Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop get ESU at no additional cost.
The backlog is hardware-bound. Windows 11 requires TPM 2.0, UEFI with Secure Boot, a compatible 64-bit processor, 4 GB of RAM, and 64 GB of storage. Microsoft offers the free upgrade only to eligible PCs, so a holdout device that fails those checks needs replacement, ESU, or a Cloud PC. StatCounter cannot say how many of the remaining 27.8% of Windows page views come from ineligible hardware. Your RMM inventory can: pull TPM version and CPU model before pricing a refresh, so the quote separates upgrade-in-place devices from replacements.
Unpatched Windows 10 is a growing exposure. Every month adds CVEs that Windows 10 devices outside ESU will never receive fixes for; our CVE statistics show the volume of new vulnerabilities more than doubling this year. Treat non-ESU Windows 10 endpoints as unsupported assets in client risk reports, and isolate any that must stay.
Plan for regional fleets. Clients with offices or users in Russia, Iran and Indonesia should expect a far higher Windows 10 count than US benchmarks suggest.
Frequently asked questions
What is the market share of Windows 11?
In September 2026, Windows 11 accounted for 71.5% of Windows desktop page views worldwide in StatCounter Global Stats. Windows was 76.4% of all desktop page views that month, so Windows 11 was about 54.6% of all desktop operating system traffic. In the United States the Windows 11 share of Windows was 80.6%.
How much market share does Windows 10 have?
Windows 10 held 27.8% of Windows desktop page views worldwide in September 2026, about 21.2% of all desktop traffic. That is down from 41.7% in October 2025, the month support ended. On Steam, Windows 10 was 24.8% of Windows gaming PCs in September 2026.
Is Windows 11 losing market share?
Not in a sustained way. Since February 2026, StatCounter’s monthly Windows 11 share of Windows desktop has moved between 67.1% and 72.6%, ending September 2026 at 71.5%. Monthly readings are noisy, so single-month dips are not a trend.
When did Windows 11 overtake Windows 10?
Worldwide, Windows 11 first passed Windows 10 in StatCounter’s data in July 2025 and has stayed ahead every month since, 45 months after its October 2021 launch. In the United States the crossover came in March 2025. On Steam it had happened by December 2024.
Where is Windows 10 still most popular?
Among the large markets we tracked with stable samples, Windows 10 still had a majority of Windows desktop page views in Russia, Iran and Indonesia in the third quarter of 2026. It was more common than Windows 11 in 3 of 48 of those markets.
Can I still get security updates for Windows 10?
Yes, through Extended Security Updates. Microsoft’s consumer ESU runs until October 12, 2027 and costs $30, 1,000 Microsoft Rewards points, or nothing if you sync PC settings. Organizations pay $61 per device for year one, doubling each year for up to three years.
Download the data.windows-version-share-by-country-2021-2026.csv (CSV): monthly Windows 11, Windows 10, Windows 7, and other Windows shares plus Windows’ share of desktop, for the world, six continents, and 59 countries, Jan 2021 to Sep 2026. Derived from StatCounter Global Stats and shared, as StatCounter’s license requires, under CC BY-SA 3.0. Credit StatCounter Global Stats (with a link) and The Uptime Report.
Methodology
Source.StatCounter Global Stats, “Windows Version Market Share” and “Operating System Market Share”, platform Desktop, monthly, downloaded as CSV from StatCounter’s chart export on 2026-10-13. Steam Hardware and Software Survey, “OS Version” section of the combined-platform page, live for September 2026 and from Internet Archive captures for earlier months. Microsoft Lifecycle, Windows release information, ESU, and Windows 11 specification pages, read on 2026-10-13.
Definitions. Unless stated, shares are of Windows desktop page views (Windows 11 plus Windows 10 plus older versions equals 100%). “Share of all desktop” multiplies a version’s share by Windows’ share of desktop page views. Quarterly figures average July, August, and September. The crossover month is the first month after which Windows 11 exceeded Windows 10 in every later month through Sep 2026. End of support is October 2025 for Windows 10 and January 2020 for Windows 7.
Coverage. World, six continents (Antarctica omitted), and the 59 countries with the largest StatCounter samples in StatCounter’s published July 2022 sample-size list. September 2026 is the latest complete month; the October 2026 value was partial at retrieval and is excluded from calculations.
Limitations. StatCounter counts page views on more than a million websites that use its tracker, without weighting, so it measures usage, not installed devices or licenses, and a busy PC counts more than an idle one. StatCounter says figures can be revised for 45 days after publication. Monthly values can swing sharply in some countries; we flag 11 markets with a single-month swing of 20 points or more and leave them out of rankings. Browsers report Windows 11 and Windows 10 with the same user-agent string, and Microsoft says sites must use User-Agent Client Hints to tell them apart, so any tracker can misclassify some Windows 11 traffic as Windows 10; StatCounter’s series shows 0% Windows 11 until January 2022 even though Steam recorded 1.82% in October 2021. Steam covers gamers only, and survey months are limited to the captures we could retrieve.
Not advice. This is an analysis of public usage data, not a licensing or procurement recommendation. Check ESU terms with Microsoft or your distributor before quoting.
Cite as:The Uptime Report. "Windows 11 Market Share Hits 71.5%, but Windows 10 Still Holds 27.8% a Year After Support Ended." October 2026. https://theuptimereport.com/windows-11-market-share/
Cloud Computing Statistics 2026: Growth Speeds Up to 43%, and Capex Rises Twice as Fast
These cloud computing statistics come straight from SEC filings, and they show cloud growth reaccelerating. In the June 2026 quarter (May for Oracle), AWS, Microsoft Intelligent Cloud, Google Cloud and Oracle cloud services earned $116.2B, up 43% from a year earlier. Google Cloud grew fastest of the big three at 82%. Capital spending grew faster still: 87%.
Most cloud statistics pages recycle survey shares and market-size forecasts. We went to the source instead: the segment notes in every 10-Q and 10-K that Amazon, Alphabet, Microsoft and Oracle filed since 2017, their earnings-release exhibits, and the XBRL cash flow data for five companies. Below is the race in revenue, growth, margin and spending, quarter by quarter.
$116.2Bcloud revenue of the four providers, Q2 2026 (+43% y/y)
+43%big-three growth, Q2 2026, up from 16% in Q2 2023
$566Bcapex, 5 companies, 12 months to Q2 2026 (+81%)
$90.1BAWS property additions in H1 2026, vs $79.8B AWS revenue
The growth race, latest quarter
Year-over-year revenue growth in the most recent quarter each company has reported. Bars run on the same scale.
Oracle OCIcloud infrastructure, Jun to Aug 2026
+121%
$7.4B
Google Cloudsegment, Q2 2026
+82%
$24.8B
Microsoft Azureas disclosed, FY26 Q4
+43%
not disclosed
AWSsegment, Q2 2026
+37%
$42.2B
Microsoft ICIntelligent Cloud segment
+32%
$39.3B
Azure growth is the percentage Microsoft discloses for “Azure and other cloud services”; Microsoft does not report Azure revenue in dollars each quarter. Oracle’s quarter ended August 31, 2026; the others ended June 30, 2026.
Quarterly cloud revenue since 2018
AWS Microsoft Intelligent Cloud Google Cloud Oracle cloud services (IaaS plus SaaS)
Segment revenue as first reported in each filing. Microsoft redefined Intelligent Cloud starting with fiscal 2025 (the quarter ended September 2024); the dotted line shows fiscal 2024 restated on the new basis, which is about $4.7B a quarter smaller. Google Cloud quarterly revenue begins in Q4 2018, the earliest quarter Alphabet disclosed. Oracle cloud services revenue begins in its fiscal 2022 and is plotted at each fiscal quarter’s end (August, November, February, May).
AWS remains the largest dedicated cloud segment at $42.2B in Q2 2026, $148B over four quarters. Microsoft’s Intelligent Cloud, which also holds server licenses such as SQL Server and Windows Server, reached $39.3B. Microsoft’s broader “Microsoft Cloud” figure, which combines Azure and other cloud services with Microsoft 365 Commercial cloud, the commercial portion of LinkedIn and Dynamics 365, was $59.3 billion in the same quarter, up 27%, and $214.4 billion for fiscal 2026. Google Cloud, which includes Workspace, hit $24.8B, nearly double its $13.6B a year earlier.
Is cloud growth reaccelerating?
Yes. On a combined basis, the big three grew 16% in Q2 2023, the slowest quarter in our series. In Q2 2026 they grew 43%, the fastest in our combined series, which starts in Q1 2020. Each company’s turn is visible on its own: the shaded band marks 2025 and 2026.
Oracle OCIcloud infrastructure, from FY2023Google Cloudsegment revenue, from Q4 2019Azuregrowth as disclosed by MicrosoftAWSsegment net sales
Year-over-year growth computed inside each filing (current quarter against the prior-year comparative in the same document), so a restatement never mixes definitions. Shared 0% to 130% scale. Hollow dot: lowest quarter between mid-2022 and mid-2025. Oracle OCI growth before fiscal 2026 is the rate stated in Oracle’s earnings releases; from fiscal 2026 it matches the XBRL figures exactly.
AWS bottomed at 12% in Q2 2023 and grew 37% in Q2 2026, its fastest since Q4 2021. Azure growth troughed at 26% and reached 43% in Microsoft’s June quarter. Google Cloud went from 22% in Q3 2023 to 82%. Oracle’s infrastructure business went from 42% to 121%; its total cloud revenue, including applications, grew 62% to $11.6B.
Every quarter since mid-2024
Quarter
AWS
Microsoft Intelligent Cloud
Google Cloud
Oracle cloud services*
Azure growth
Four-provider total
Q2 2026
$42.2B+37%
$39.3B+32%
$24.8B+82%
$9.9B+47%
+43%
$116.2B
Q1 2026
$37.6B+28%
$34.7B+30%
$20.0B+63%
$8.9B+44%
+40%
$101.2B
Q4 2025
$35.6B+24%
$32.9B+29%
$17.7B+48%
$8.0B+34%
+39%
$94.1B
Q3 2025
$33.0B+20%
$30.9B+28%
$15.2B+34%
$7.2B+28%
+40%
$86.2B
Q2 2025
$30.9B+17%
$29.9B+26%
$13.6B+32%
$6.7B+27%
+39%
$81.1B
Q1 2025
$29.3B+17%
$26.8B+21%
$12.3B+28%
$6.2B+23%
+33%
$74.5B
Q4 2024
$28.8B+19%
$25.5B+19%
$12.0B+30%
$5.9B+24%
+31%
$72.2B
Q3 2024
$27.5B+19%
$24.1B+20%
$11.4B+35%
$5.6B+21%
+33%
$68.5B
Revenue with year-over-year growth below. *Oracle’s fiscal quarter ending two months into the calendar quarter shown (for Q2 2026, March to May 2026). All Microsoft rows are on the current Intelligent Cloud definition. Full series back to 2016 in the download.
Who makes the most money on cloud?
AWS and Google Cloud margins rose along with growth; Microsoft’s Intelligent Cloud margin peaked at 48.4% in Q3 2023 on its old definition and has run between 39.7% and 43.6% since the resegmentation. In Q2 2026, Microsoft’s Intelligent Cloud earned an operating margin of 40.6%, AWS 39.4% and Google Cloud 35.6%. Google Cloud lost $1.2B in Q4 2019, a margin of -46%, and reported its first operating profit in Q1 2023, under Alphabet’s revised cost allocation. In Q2 2026 it earned $8.8B, more than AWS earned in any quarter before 2024. Oracle does not report a profit figure for cloud on its own, so it is not in this comparison.
AWS Microsoft Intelligent Cloud Google Cloud
Segment operating income divided by segment revenue. Google Cloud: dashed line is 2019 to 2021 as originally reported; from 2022 the figures reflect Alphabet’s 2023 change in cost allocation, which moved some costs out of the segment and restated 2022. Microsoft: break at the fiscal 2025 resegmentation.
Provider
Period
Revenue
Growth y/y
Operating income
Margin
Last 4 quarters
AWS Amazon Web Services segment
Q2 2026
$42.2B
+37%
$16.6B
39.4%
$148.4B
Microsoft Intelligent Cloud segment (FY26 Q4)
Q2 2026
$39.3B
+32%
$16.0B
40.6%
$137.8B
Google Cloud Google Cloud segment
Q2 2026
$24.8B
+82%
$8.8B
35.6%
$77.6B
Oracle Cloud services, IaaS plus SaaS (FY27 Q1)
Jun to Aug 2026
$11.6B
+62%
not disclosed
n/a
$38.4B
Oracle of which cloud infrastructure (OCI)
Jun to Aug 2026
$7.4B
+121%
not disclosed
n/a
$22.1B
Capex is growing faster than cloud revenue
The AI and data center buildout shows up in the cash flow statements. Amazon, Microsoft, Alphabet, Oracle and Meta paid $181.5B for property and equipment in Q2 2026, up 87% from $97.3B. Over 12 months the total was $566B, up 81%, while the four cloud businesses grew revenue 34% to $398B. Oracle grew capex fastest, 162% over the same 12 months.
Amazon Microsoft Alphabet Oracle Meta AWS + Microsoft IC + Google Cloud revenue
Cash paid for property and equipment (XBRL PaymentsToAcquirePropertyPlantAndEquipment; Amazon PaymentsToAcquireProductiveAssets), quarterly values derived from year-to-date cash flow statements. Excludes assets acquired under finance leases. Oracle quarters (ending February, May, August, November) are placed in the calendar quarter they mostly overlap. Company-wide capex, not cloud only.
For the first time in our series, and in every quarter since Q4 2025, Amazon, Microsoft and Alphabet together have spent more on property and equipment each quarter than their three cloud segments brought in as revenue. In Q2 2026 the three spent $134.9B against $106.3B of cloud revenue. Meta sells no cloud services; it is shown for scale and left out of every revenue comparison.
Year
Amazon
Microsoft
Alphabet
Oracle
Meta
Total
Change
2018
$13.4B
$14.2B
$25.1B
$1.5B
$13.9B
$68.2B
2019
$16.9B
$13.5B
$23.5B
$1.6B
$15.1B
$70.6B
+4%
2020
$40.1B
$17.6B
$22.3B
$1.8B
$15.2B
$97.0B
+37%
2021
$61.1B
$23.2B
$24.6B
$3.1B
$18.7B
$130.7B
+35%
2022
$63.6B
$24.8B
$31.5B
$6.7B
$31.2B
$157.8B
+21%
2023
$52.7B
$35.2B
$32.3B
$6.9B
$27.0B
$154.2B
-2%
2024
$83.0B
$55.6B
$52.5B
$10.7B
$37.3B
$239.1B
+55%
2025
$131.8B
$83.1B
$91.4B
$35.5B
$69.7B
$411.5B
+72%
12 months to Q2 2026
$173.0B
$115.9B
$132.4B
$55.7B
$89.3B
$566.4B
+81%
Calendar years, summing quarters that end in the year (for Oracle, December to November).
AWS: spending more on new property than it earns
Company-wide capex mixes cloud with warehouses, search and social apps. Amazon reports net additions to property and equipment for the AWS segment itself, a measure that includes finance leases and equipment acquired but not yet paid for, so it runs ahead of cash capex. AWS added $96.5B of property and equipment in 2025, 75% of its revenue. In the first half of 2026 it added $90.1B, more than the $79.8B it earned, up from $36.5B against $60.1B a year earlier.
Year
AWS revenue
AWS operating income
Margin
AWS net property additions
Additions as % of revenue
2018
$25.7B
$7.3B
28.4%
$9.8B
38%
2019
$35.0B
$9.2B
26.3%
$13.1B
37%
2020
$45.4B
$13.5B
29.8%
$16.5B
36%
2021
$62.2B
$18.5B
29.8%
$22.0B
35%
2022
$80.1B
$22.8B
28.5%
$27.8B
35%
2023
$90.8B
$24.6B
27.1%
$24.8B
27%
2024
$107.6B
$39.8B
37.0%
$53.3B
50%
2025
$128.7B
$45.6B
35.4%
$96.5B
75%
H1 2026
$79.8B
$30.8B
38.6%
$90.1B
113%
Is cloud computing in high demand?
Contracted revenue not yet recognized, reported as remaining performance obligations (RPO), have grown much faster than revenue. Combined RPO at the four companies rose 109% in a year to $2.36 trillion. Alphabet’s rose from $108B to $520B, of which it attributes $513.9B to Google Cloud. Amazon’s rose from $195B to $496B, which it says relate primarily to AWS; its 10-Q also notes expanded multi-year commitments from OpenAI and Anthropic in 2026. Microsoft’s and Oracle’s totals are company-wide, so they include some non-cloud contracts.
Company
As of
RPO
A year earlier
Change
Amazon
Jun 2026
$496B
$195B
+154%
Microsoft
Jun 2026
$684B
$375B
+82%
Alphabet
Jun 2026
$520B
$108B
+380%
Oracle
Aug 2026
$664B
$455B
+46%
The public cloud is one slice of the market. For the wider hosting and data processing industry measured by the Census Bureau, see our report on IT services industry growth, which tracks NAICS 518 revenue alongside traditional IT services.
What this means for MSPs
Three numbers in these filings are worth carrying into client conversations. First, margins: the AWS and Microsoft cloud segments earned operating margins of 39% and 41% in the latest quarter, so a client’s cloud bill carries real margin, and commitment discounts, right-sizing and license reviews are worth a scheduled review rather than a one-off project. Second, where the money goes: AWS added $90.1B of property in six months, and Microsoft’s 10-K says its capital spending supports cloud and AI infrastructure. New regions, instance types and AI services will keep arriving, and a short quarterly summary of what changed for each client’s stack is a service clients can see. Third, concentration: Alphabet and Amazon both report backlogs several times their annual cloud revenue, much of it in large multi-year contracts, so keep exit costs, data egress and a second-provider option in client roadmaps. When you price that work, compare against our IT hourly rates data, and for the managed services side of the market see our MSP industry statistics.
Frequently asked questions
Is cloud computing still growing?
Yes, and faster than a year ago. Combined revenue of AWS, Microsoft Intelligent Cloud and Google Cloud grew 43% year over year in the quarter ended June 2026, up from a low of 16% in Q2 2023. Adding Oracle cloud services, the four providers booked $116.2B in the quarter.
Which cloud provider is growing the fastest?
Among the three largest, Google Cloud: revenue rose 82% to $24.8B in Q2 2026, against 43% for Azure and 37% for AWS. Oracle’s cloud infrastructure grew faster still, 121% in the quarter ended August 2026, from a smaller base of $7.4B.
Who is the biggest cloud provider?
AWS has the largest dedicated cloud segment: $148B of revenue over the four quarters to June 2026. Microsoft’s Intelligent Cloud segment earned $138B in fiscal 2026, and Microsoft says Azure alone passed $100 billion. Google Cloud earned $78B, including Workspace.
How much are cloud companies spending on data centers?
Amazon, Microsoft, Alphabet, Oracle and Meta paid $566B for property and equipment in the 12 months to Q2 2026 (Oracle to May), up 81% on the prior 12 months. In Q2 2026 alone it was $182B, up 87%.
Is cloud computing in high demand?
Contract backlogs say yes. Remaining performance obligations at Amazon, Microsoft, Alphabet and Oracle totaled $2.36 trillion at their latest quarter, up 109% in a year. These are company-wide figures, not cloud-only.
Is cloud computing oversaturated?
Not on these numbers. Growth accelerated at all four providers in 2025 and 2026, and AWS and Google Cloud margins rose: AWS earned a 39.4% operating margin in Q2 2026 and Google Cloud 35.6%, up from losses until Q1 2023.
Sources. SEC EDGAR, retrieved October 13, 2026: the XBRL instance documents of every 10-Q and 10-K filed since mid-2017 by Amazon (CIK 1018724), Microsoft (789019), Alphabet (1652044) and Oracle (1341439); their earnings releases (8-K Item 2.02, Exhibit 99.1); and the XBRL company facts API for capex and remaining performance obligations of those four plus Meta (1326801). Latest filings used: Amazon and Alphabet 10-Q for the quarter ended June 30, 2026; Microsoft 10-K for fiscal 2026 (ended June 30, 2026); Oracle 10-Q for the quarter ended August 31, 2026; Meta 10-Q for June 30, 2026.
Definitions. AWS: Amazon Web Services segment net sales and operating income. Microsoft: Intelligent Cloud segment revenue and operating income, plus Azure growth rates and Microsoft Cloud revenue as stated in earnings releases (the growth metric is “Azure” until fiscal 2021 and “Azure and other cloud services” after). Google Cloud: Alphabet’s Google Cloud segment, which includes Google Cloud Platform and Workspace. Oracle: “cloud services” revenue (IaaS plus SaaS) and, from fiscal 2025, cloud infrastructure revenue as tagged in XBRL; Oracle’s cloud figure excludes license support. Capex: cash paid for property and equipment.
Calculations. Quarterly values come from three-month facts; fourth quarters are the annual 10-K figure minus the first three quarters. Growth rates are computed inside each filing against the prior-year comparative in that same filing, which keeps restatements consistent. Levels are as first reported. Quarterly capex is derived by differencing year-to-date cash flow figures. Spot checks against earnings releases match: AWS Q2 2026 $42.2 billion, up 37%; Google Cloud Q2 2026 $24.8 billion, up 82%; Microsoft Intelligent Cloud Q4 fiscal 2024 $28,515 million.
Breaks and limits. Microsoft resegmented Intelligent Cloud from fiscal 2025 and made a smaller restatement in fiscal 2023; we never join the old and new definitions in one growth rate. Alphabet changed its cost allocation in 2023 and restated Google Cloud operating income for 2021 and 2022; our margin chart uses the restated 2022 quarters and original figures before that. Alphabet did not disclose quarterly Google Cloud revenue before Q4 2018 or quarterly segment profit before Q4 2019. The four cloud businesses are defined differently (Microsoft’s segment includes server licenses, Google’s includes Workspace), so dollar comparisons are approximate; growth and margin comparisons are more like-for-like. Capex and RPO are company-wide.
Not advice. This is an analysis of public company filings, not investment advice.
Cite as:The Uptime Report. "Cloud Computing Statistics 2026: Growth Speeds Up to 43%, and Capex Rises Twice as Fast." October 2026. https://theuptimereport.com/cloud-computing-statistics/
AWS Outage History: 12 of 18 Major Outages Hit us-east-1, and the Longest of All Has No Post-Event Summary
AWS outage history, from AWS’s own records: Amazon has published 18 Post-Event Summaries for major outages since April 2011, and 12 of them were in us-east-1 (Northern Virginia). The median event lasted 6.2 hours. 13 of the 18 were software, configuration, or capacity failures rather than power. In 2026, drone strikes damaged two Middle East regions that AWS has not summarized.
18AWS Post-Event Summaries, April 2011 to October 2025
12 of 18in us-east-1, including all 3 since 2022
6.2 hmedian headline duration (17 events with a stated end)
13 of 18software, configuration, or capacity; 9 began with a change or scaling action
226 daysUAE Region listed as disrupted on the AWS Health Dashboard, as of Oct 13, 2026
We read every summary on AWS’s Post-Event Summaries index and extracted the region, the start and end times AWS gives, the services named, and the root cause. AWS writes a PES only when an issue has “broad and significant customer impact”, so this is a log of the largest events, not every blip on the status page. Below it, we compare Google Cloud’s public incident feed and Azure’s post incident reviews.
The AWS outage timeline, 2011 to 2026
Latent software bug (6)Operator error in a change (4)Capacity or limit exceeded (3)Facility power or cooling (5)Physical damage, Health Dashboard only (2)
Mar 022026
me-south-1 Bahrain · one AZ, then a second in April · 225 days and still listed as disrupted
AWS says a drone strike near one facility caused physical damage, a second AZ was disrupted in April, and on September 15, 2026 it said it cannot restore resources and data hosted only in the Region.
Services: 149 listed as impacted on the public dashboard
me-central-1 UAE · two of three AZs impaired · 226 days and still listed as disrupted
AWS says two of its UAE facilities were directly struck by drones, and by April 30 the Region was "unable to reliably support customer applications". On September 15, 2026 it said it cannot restore resources and data hosted only in the mec1-az2 zone.
Services: 140 listed as impacted on the public dashboard
us-east-1 N. Virginia · regional service · 14 h 32 min(last service back after 1 d 4 h 17 min)
A latent race condition in DynamoDB’s automated DNS management left the regional endpoint with an empty DNS record that the automation could not repair.
Services: DynamoDB, EC2, Network Load Balancer, Lambda, ECS/EKS/Fargate, Connect, STS, IAM sign-in, Redshift, Support
us-east-1 N. Virginia · regional service · 4 h 51 min(last service back after 8 h 33 min)
A brief network disruption hit a DynamoDB metadata service that lacked capacity for membership lists that had grown with Global Secondary Index adoption.
Services: DynamoDB, SQS, EC2 Auto Scaling, CloudWatch, Console
us-east-1 N. Virginia · regional service · 2 h(last service back after 4 h 14 min)
Power loss to storage nodes in one data center overloaded a lock service whose handshake timeout was set too low, and nodes removed themselves from the cluster.
us-east-1 N. Virginia · regional service · 22 h 6 min(last service back after 23 h 41 min)
A maintenance process was run against production by mistake and deleted part of the ELB control plane’s state data.
Services: Elastic Load Balancing
Cause:Operator error in a change · began with: maintenance process run against production · AWS Post-Event Summary
Oct 222012
us-east-1 N. Virginia · single AZ · 6 h 15 min(last service back after 11 h 50 min)
A DNS change after a server replacement did not fully propagate, which set off a latent memory leak in the EBS data-collection agent.
Services: EBS, EC2 APIs, RDS, ELB
Cause:Latent software bug · began with: DNS update after a server replacement · AWS Post-Event Summary
Jun 292012
us-east-1 N. Virginia · single AZ · 4 h 21 min(last service back after 6 h 41 min)
An electrical storm cut utility power twice and one data center’s generators failed to provide stable voltage, so servers lost power when UPS units drained.
Services: EC2, EBS, RDS, ELB (region-wide EC2 control plane for 66 minutes)
eu-west-1 Ireland · single AZ · 3 h 8 min(last service back after 3 d 9 h 44 min)
A utility transformer failed and a PLC did not bring backup generators online, cutting power to most of one Availability Zone. AWS's index lists this summary under August 7, 2014; the text (a Friday, August 5 and a Sunday, August 7) and contemporary coverage place it in 2011.
us-east-1 N. Virginia · single AZ · 2 d 17 h 28 min(last service back after 3 d 11 h 43 min)
A network upgrade’s traffic shift was executed incorrectly, cutting EBS nodes off from their replicas and setting off a re-mirroring storm.
Services: EC2, EBS, RDS (EBS APIs region-wide for two periods)
Cause:Operator error in a change · began with: network capacity upgrade · AWS Post-Event Summary
Duration is the headline window: first customer impact to the time AWS gives for recovery of the main affected services. The figure in brackets runs to the last recovery time AWS reports for any service, such as cleared backlogs. Dates are the day the event began in the time zone AWS used (Pacific for most US and global events).
Does us-east-1 dominate AWS outages?
Yes. 12 of the 18 summaries, or 67%, describe events in Northern Virginia, and every summary since 2022 is a us-east-1 event. Tokyo is the only other region with more than one. Events in us-east-1 were not shorter either: the median headline window there was 6.6 hours, against 5.9 hours for the other regions.
Latent software bug (6)Operator error in a change (4)Capacity or limit exceeded (3)Facility power or cooling (5)
Count of AWS Post-Event Summaries by region, coloured by root-cause category. The two 2026 Middle East events are not included because AWS has not published summaries for them.
The October 2025 summary shows why a Northern Virginia failure can reach customers who do not run there. AWS wrote that customers using root credentials, or identity federation through signin.aws.amazon.com, “experienced errors when trying to log into the AWS Management Console in regions outside of the N. Virginia (us-east-1) Region”, and that Redshift customers in all regions could not use IAM user credentials because of a dependency on an IAM API in us-east-1.
What causes AWS outages: changes and software, not power
We assigned each summary to one category, based on the failure that AWS says defeated its redundancy. 13 of 18 were software, configuration, or capacity problems: 6 latent software bugs, 4 operator errors during a change, and 3 cases where load exceeded a capacity or configured limit. The other 5 were facility power or cooling failures.
One dot per AWS Post-Event Summary, by year the event began. Open circles: the 2026 UAE and Bahrain disruptions, which appear only on the AWS Health Dashboard.
9 of the 18 began with something AWS itself did: a network upgrade, a configuration push, a capacity addition or removal, a fleet scaling step, or a routine deployment. In the October 2025 event the trigger sat inside automation that keeps DNS records updated frequently, and AWS disabled that automation worldwide afterwards. The last summarized facility failure was the Tokyo cooling event in August 2019; all 6 summaries from 2020 to 2025 were software or capacity events in regional services.
2026 broke that pattern in the worst way. On March 1, AWS reported that “objects” had struck a data center in the UAE Region, starting a fire. Two days later it said drone strikes had hit two of its UAE facilities and damaged infrastructure near one in Bahrain. Storms and grid faults caused earlier physical failures, which is why FEMA’s record on disaster declarations by state belongs in a continuity plan alongside cloud status data.
How long AWS outages last
The median headline window across the 17 events with a stated end time was 6.2 hours. Backlogs often stretch impact well beyond that: measured to the last recovery AWS reports, the median is 9.6 hours. The October 2025 DynamoDB event ran 14 h 32 min, the fourth-longest headline window in the record, and some Redshift clusters stayed impaired until the next morning.
Headline window, coloured by causeUntil last service recovered
Axis capped at 36 hours; arrows mark bars that run past it. Hover for exact values.
The 2026 Middle East events are on a different scale. Adding up every summarized event’s full duration, to the last recovery AWS reports, gives 344 hours, about 14 days. The UAE disruption alone had been open 226 days by October 13, 2026.
n/s: not stated. The December 2013 Sao Paulo summary gives a start time but no end time.
How AWS compares with Google Cloud and Azure
The three providers do not publish on the same terms, so counts across them are not a reliability ranking. AWS posts a PES only for broad, significant events. Google’s public dashboard lists many smaller incidents, including informational ones. Azure’s history page holds post incident reviews (PIRs) and preliminary reviews for incidents that Microsoft chooses to document publicly.
Google’s incidents.json feed only holds about the last 12 months, so we rebuilt its history by combining 91 readable monthly Internet Archive captures of the feed with the live file, which yields 1,471 incidents since 2013. From 2018, when the captures run without gaps, the count peaked at 351 in 2023, fell to 164 in 2024, and then to just 22 in 2025. Google’s own product history pages show the same counts (351 for 2023, 164 for 2024, 22 for 2025), so the drop is in what Google publishes, not in our reconstruction. The page now points customers to Personalized Service Health for incidents affecting their own projects.
All incidents on Google’s public dashboardSeverity “high”
*2026 is January 1 to October 13. Year of incident start, UTC.
Year
Google incidents
High severity
Share high
Low (informational)
Median duration
Median, high only
Azure PIRs
2018
93
31
33%
0
1.2 h
1.0 h
2019
131
20
15%
0
2.8 h
3.7 h
2020
148
10
7%
0
1.7 h
2.3 h
2021
145
8
6%
0
2.6 h
2.1 h
partial
2022
210
25
12%
120
3.1 h
1.6 h
24
2023
351
13
4%
279
2.9 h
5.6 h
13
2024
164
28
17%
91
3.9 h
3.4 h
15
2025
22
4
18%
12
5.2 h
4.1 h
13
2026*
7
1
14%
1
10.7 h
3.7 h
9
Google relabeled severity over time: “low” first appears for informational posts in 2022, so the share rated high is not comparable across all years. Azure’s history page lists 84 entries, the earliest dated July 2021; 2021 is partial.
Google Cloud. 45 incidents rated high severity in 2023 to 2025. One of the four in 2025, a multi-product incident on June 12, lasted 7.5 hours by Google’s begin and end times.
Azure. 24 post incident reviews in 2022, 13 in 2023, 15 in 2024, and 13 in 2025, with 9 so far in 2026.
What this means for MSPs
Multi-AZ covers the facility risk, not the software risk. All 5 power or cooling events in the summaries were confined to one Availability Zone, and after the 2011 Ireland and 2019 Tokyo facility failures (and a single-zone EBS failure in Virginia in October 2012) AWS wrote that customers running across zones kept working or saw limited impact. But 11 of the 13 software, configuration, and capacity events broke a regional service such as S3, DynamoDB, Kinesis, or Lambda, where a second zone does not help. For client workloads that cannot go down for a working day, the realistic design is a warm standby in a second region, with data replication tested on a schedule. In October 2025, AWS noted that customers with DynamoDB global tables could still read and write their replicas in other regions.
Keep backups outside the region. The 2026 Bahrain update is the clearest warning in AWS’s record: the damage “exceeded what our regional and multi-AZ services are designed to withstand”, and AWS said it cannot restore resources and data hosted only in that region. For managed clients, that means cross-region backup copies (or a second provider) are a requirement, and restore tests should include a different region.
Do not rely on the public status page alone. In 3 of the 18 summaries (2017, 2020, and 2021), AWS says its own Service Health Dashboard could not be updated normally during the event, and in March 2026 AWS moved Middle East updates to the account-level Personal Health Dashboard. Wire AWS Health events from each client account into your PSA or alerting tool, add synthetic checks from outside AWS, and treat the public page as a backup.
Plan for us-east-1 specifically. It hosts most of the summarized events and some global sign-in and IAM paths. Keep break-glass access that does not depend on a single identity path, and avoid placing a client’s only copy of anything there by default. As cloud hosting keeps growing faster than the rest of the IT services industry, a single region failure reaches more of a typical MSP’s client base.
Frequently asked questions
When was the last major AWS outage?
The most recent AWS Post-Event Summary covers the DynamoDB DNS failure in us-east-1 on October 19 and 20, 2025, which lasted 14 h 32 min by AWS’s own start and end times. Separately, the AWS Health Dashboard has listed the UAE (me-central-1) and Bahrain (me-south-1) Regions as disrupted since March 1 and 2, 2026, after drone strikes. AWS had not published a summary for those events as of October 13, 2026.
How often does AWS have major outages?
AWS has published 18 Post-Event Summaries covering April 2011 to October 2025: 8 in 2011 to 2015, 5 in 2016 to 2020, and 5 in 2021 to 2025. That is about one qualifying event a year, with no upward trend. AWS writes a summary only for broad, significant events, so smaller incidents do not appear in this count.
What caused AWS to go down?
In 13 of the 18 summarized events the cause was software, configuration, or capacity rather than power or cooling. 9 began with a change, deployment, or scaling action. The October 2025 outage came from a latent race condition in DynamoDB’s automated DNS management, which left the regional endpoint with an empty DNS record.
Which AWS region has the most outages?
us-east-1 (Northern Virginia) accounts for 12 of the 18 Post-Event Summaries, including all 3 published since 2022. No other region has more than 2.
How long do AWS outages last?
Across the 17 summarized events with a stated end time, the median headline window was 6.2 hours. The shortest was 1 h 24 min (Seoul, 2018) and the longest 2 d 17 h 28 min (Northern Virginia, April 2011). Backlogs often ran longer: the median time to the last recovery AWS reports was 9.6 hours.
Does running in multiple Availability Zones protect against AWS outages?
Against facility failures, mostly yes: all 5 power or cooling events in the summaries hit a single Availability Zone, and AWS wrote in several summaries that customers spread across zones kept running. Against software failures, much less: 11 of the 13 software, configuration, or capacity events took down a regional service, where only a second region helps.
Sources. AWS Post-Event Summaries index and all 18 linked summary pages; AWS Health Dashboard public current-events feed; Google Cloud Service Health incidents.json, 91 readable monthly Internet Archive captures of it (5 more were unreadable), and Google’s per-product history pages; Azure status history (all entries via the page’s own history endpoint). All retrieved October 13, 2026.
AWS extraction. For each summary we recorded the first customer-impact time and the recovery time AWS gives for the main affected services (the headline window), plus the latest recovery time AWS reports for any service. Every timestamp and cause in our dataset is tied to a verbatim sentence from the summary, which our build script checks against the saved page text. Where AWS states an event window (October 2025), we use it. Durations are computed across time zones.
Cause categories. One category per event, based on the failure AWS says defeated its redundancy: latent software bug, operator error in a change, capacity or limit exceeded, or facility power or cooling. “Began with a change” marks events AWS says were set off by a deployment, configuration update, capacity change, maintenance task, or scaling action. Scope is “single AZ” when AWS describes the primary impact as confined to one Availability Zone.
Date correction. AWS’s index lists the EU West (Ireland) summary under August 7, 2014. The summary’s own text refers to “Friday, August 5th” and Sunday, August 7, which matches 2011, and InfoWorld reported the event on August 15, 2011. We date it 2011.
Limitations. Post-Event Summaries cover only events AWS judges broad and significant, and AWS commits to keeping them for at least five years; older summaries may have been removed. The count is not a measure of total downtime and says nothing about smaller incidents. The 2026 Middle East events come from the public Health Dashboard, which AWS stopped updating in detail after March 3, 2026. Google and Azure publish under different rules, so cross-provider counts are context, not a ranking.
Not advice. This is an analysis of public incident records, not an architecture recommendation for any specific environment.
Cite as:The Uptime Report. "AWS Outage History: 12 of 18 Major Outages Hit us-east-1, and the Longest of All Has No Post-Event Summary." October 2026. https://theuptimereport.com/aws-outage-history/
Uptime Report Research · Layoff TrackerLast updated October 13, 2026: notices through October 7
Tech Layoffs 2026: WARN Notices Show Tech Job Cuts Doubled While Other Layoffs Fell
Tech layoffs 2026, counted from the legal record: WARN Act notices filed in California, Washington and New York name 23,178 workers at tech employers from January to September 2026, up 99.7% from 11,609 in the same months of 2025. Layoffs at all other employers in the same filings fell 23%.
23,178tech workers in WARN notices, Jan to Sep 2026 (CA, WA, NY)
+99.7%vs 11,609 in Jan to Sep 2025
24%tech share of all WARN workers, up from 11%
42%of 2026 tech workers are at Meta or Amazon corporate offices
The best-known layoff trackers tally cuts reported in the press. This one counts notices that employers are legally required to file before a mass layoff, using the notice files that California’s Employment Development Department, Washington’s Employment Security Department and New York’s Department of Labor publish. We matched every employer name against a published list of 108 tech companies (the full list is in the methodology) and summed the workers each notice names.
Tech workers in WARN notices, week by week in 2026
Internet and platformsSoftware and gamesChips and hardwareIT services
Seven-day periods starting January 1, 2026, through October 7. Workers summed across all sites in each notice. Hover a bar for the employers behind it. New York’s newest weeks fill in as the state posts notices, which can take several weeks.
The year has come in waves rather than a steady drip. The biggest week was driven by Meta, which filed for 4,665 workers that week. Amazon’s corporate notices in late January and Meta’s notices in May together make January (5,515) and May (6,723) the two heaviest months. The largest single notice of 2026 is Meta in California on May 26, covering 2,599 workers across 3 sites.
Tech layoffs 2026 vs 2025
2025 2026 (January to September)
Tech workers in WARN notices by month, California, Washington and New York combined. October to December 2026 not yet available.
Compared month for month, January to September 2026 named 2.00 times as many tech workers as the same months of 2025. Part of the reason 2025 looks lighter is timing: Amazon’s large corporate cut landed in October 2025, when its notices in the three states named 4,130 workers, and the fourth quarter of 2025 alone added 6,544 tech workers. Even counting all of 2025 (18,153 tech workers), the first nine months of 2026 have already passed the full-year total.
The rise is specific to tech. Across every employer in the same notice files, workers named fell from 107,656 to 96,794, so non-tech layoffs dropped 23% while tech layoffs roughly doubled. For a broader view of hiring, quits and layoffs across the information sector, our analysis of the tech job market in 2026 from BLS JOLTS data tracks the federal survey numbers.
Category
Jan to Sep 2025
Jan to Sep 2026
Change
Employers 2025
Employers 2026
Internet and platforms
1,333
13,464
+910%
10
21
Software and games
6,670
7,401
+11%
20
26
Chips and hardware
3,335
2,280
-32%
17
11
IT services
271
33
-88%
3
3
All tech
11,609
23,178
+99.7%
50
61
The mix has shifted. Internet and platform companies went from 1,333 workers to 13,464, almost all of it Meta and Amazon. Chips and hardware fell, from 3,335 to 2,280, after a 2025 in which Intel alone filed for 1,590 workers in those months. Microsoft, Amazon, Meta, Google and Apple together account for 10,889 workers in January to September 2026 notices against 3,503 in the same months of 2025.
Which companies are doing layoffs in 2026?
The leaderboard ranks tech employers by workers named in their 2026 WARN notices in the three states, through October 7. A company that files one notice per building appears once here, with all sites added together.
1MetaCA WA · Internet and platforms5,736
2Amazon (corporate offices)CA NY WA · Internet and platforms4,085
3OracleCA NY WA · Software and games2,039
4IntuitCA · Software and games910
5MicrosoftWA · Software and games882
6LinkedInCA · Internet and platforms606
7UberCA WA · Internet and platforms556
8LeeMAH ElectronicsCA · Chips and hardware479
9CiscoCA · Chips and hardware471
10eBayCA · Internet and platforms469
11SnapCA WA · Internet and platforms415
12ServiceNowCA · Software and games404
13JabilCA · Chips and hardware382
14AtlassianCA WA · Software and games315
15WorkdayCA · Software and games296
States where each employer filed in 2026 and its category. Amazon counts corporate office notices only; Amazon Fresh stores and warehouses are excluded.
Where the notices were filed
State
All WARN workers 2025
All WARN workers 2026
Tech 2025
Tech 2026
Tech share 2025
Tech share 2026
California
74,772
58,200
7,013
15,029
9.4%
25.8%
Washington
18,196
26,687
4,178
7,751
23.0%
29.0%
New York
14,688
11,907
418
398
2.8%
3.3%
Three states
107,656
96,794
11,609
23,178
10.8%
23.9%
January to September of each year. New York requires notice for layoffs of 25 or more at a site, half the 50-worker trigger in California and Washington, so its files hold many smaller non-tech layoffs.
California carries the most volume and the biggest swing: 15,029 tech workers in January to September 2026 notices, and tech’s share of all California WARN workers rose from 9% to 26%. In Washington, tech workers rose from 4,178 to 7,751, led by Amazon, Meta, Microsoft and Oracle. New York’s tech filings were flat and small in both years.
Will tech layoffs continue in 2026?
The notices answer part of this, because WARN requires warning before the cut. Notices already on file list 3,364 tech workers at 15 employers whose separations are dated after October 7, 2026, the end of our data. September 2026 brought 2,242 tech workers in new notices, compared with 1,316 in September 2025. That is a filing pace, not a forecast: a large notice from one company can move a month by thousands.
Where are IT services firms and MSPs?
Almost absent. IT services employers, meaning IT consulting, systems integration, IT staffing and managed services, account for 33 of the 23,178 tech workers in January to September 2026 notices (0.1%), down from 271 in the same months of 2025. That does not show managed service providers are holding headcount. WARN only sees cuts above a size threshold: California and Washington require a notice only when 50 or more workers lose jobs at a single site within 30 days, so layoffs at smaller IT firms do not appear here.
What this means for MSPs
Nine in ten tech workers in 2026 notices (90%) are at internet platforms and software companies, not at the infrastructure and services firms MSPs compete with. For MSPs hiring, the notices are a free, dated signal: each filing names the site and the date separations begin, and the law requires 60 days’ warning in California and Washington. Recruiting outreach can be timed to those dates rather than to headlines.
Do not read the platform cuts as a signal that IT operations work is shrinking at the same rate. The categories closest to MSP work barely appear in WARN filings, and roles differ: security work is projected to grow faster than IT support in the BLS outlook for IT and cybersecurity jobs. If a client files a notice, the separation date on the filing is also the deadline for offboarding: account removal, license reclaim and device recovery for every worker on the list.
All 2026 tech WARN notices
Every 2026 tech notice in the three states, one row per employer, state and filing date, with sites added together. Click a column heading to sort.
Filed
Employer
State
Category
Workers
Sites
Separations begin
Oct 2
Magic Leap
CA
Chips and hardware
5
1
Dec 1, 2026
Sep 29
Workday
CA
Software and games
142
1
Nov 30, 2026
Sep 22
Microsoft
WA
Software and games
277
1
Nov 21, 2026
Sep 22
Expedia
WA
Internet and platforms
58
1
Nov 21, 2026
Sep 18
Intel
CA
Chips and hardware
52
4
Sep 30, 2026
Sep 15
Oracle
CA
Software and games
441
3
Nov 13, 2026
Sep 15
Uber
CA
Internet and platforms
253
2
Nov 2, 2026
Sep 14
Oracle
WA
Software and games
359
1
Nov 13, 2026
Sep 14
Uber
CA
Internet and platforms
137
2
Nov 2, 2026
Sep 14
LeeMAH Electronics
CA
Chips and hardware
62
1
Dec 21, 2026
Sep 2
Qualtrics
WA
Software and games
117
1
Oct 18, 2026
Sep 2
Uber
WA
Internet and platforms
93
1
Nov 2, 2026
Sep 1
PayPal
CA
Internet and platforms
251
1
Oct 30, 2026
Aug 31
Amazon (corporate offices)
CA
Internet and platforms
148
2
Oct 20, 2026
Aug 31
Synopsys
CA
Software and games
128
1
Dec 16, 2026
Aug 31
Amazon (corporate offices)
WA
Internet and platforms
121
1
Oct 1, 2026
Aug 21
Jabil
CA
Chips and hardware
382
1
Nov 23, 2026
Aug 18
TikTok and ByteDance
WA
Internet and platforms
75
1
Oct 19, 2026
Aug 17
LeeMAH Electronics
CA
Chips and hardware
205
1
Oct 16, 2026
Aug 14
Netflix
CA
Internet and platforms
59
1
Jul 14, 2026
Aug 5
Salesforce
CA
Software and games
74
1
Oct 5, 2026
Aug 5
Salesforce
WA
Software and games
59
1
Oct 5, 2026
Aug 5
Google
WA
Internet and platforms
52
1
Sep 6, 2026
Aug 4
Zillow
WA
Internet and platforms
91
1
Oct 5, 2026
Aug 4
Nutanix
CA
Software and games
65
1
Oct 5, 2026
Aug 3
Chime
CA
Internet and platforms
135
1
Sep 30, 2026
Jul 31
Veritone
CA
Software and games
10
1
Sep 28, 2026
Jul 29
Tencent America
CA
Internet and platforms
68
1
Sep 28, 2026
Jul 28
ServiceNow
CA
Software and games
287
2
Sep 28, 2026
Jul 27
Intel
CA
Chips and hardware
103
4
Aug 15, 2026
Jul 23
Uber
CA
Internet and platforms
41
3
Sep 21, 2026
Jul 22
Stefanini
NY
IT services
24
1
Sep 20, 2026
Jul 20
Magic Leap
CA
Chips and hardware
76
1
Oct 1, 2026
Jul 15
Coursera
CA
Internet and platforms
31
1
Sep 11, 2026
Jul 14
Udemy
CA
Internet and platforms
28
1
Sep 11, 2026
Jul 8
LeeMAH Electronics
CA
Chips and hardware
212
1
Sep 8, 2026
Jul 7
Obsidian Entertainment
CA
Software and games
52
1
Sep 4, 2026
Jul 6
Microsoft
WA
Software and games
605
1
Sep 4, 2026
Jul 2
Amazon (corporate offices)
WA
Internet and platforms
57
1
Aug 3, 2026
Jun 29
Robinhood
CA
Internet and platforms
63
1
Sep 1, 2026
Jun 25
Bungie (Sony Interactive)
WA
Software and games
292
1
Jul 9, 2026
Jun 24
Cisco
CA
Chips and hardware
236
1
Jul 13, 2026
Jun 24
BILL
CA
Software and games
129
1
Aug 24, 2026
Jun 23
Cisco
CA
Chips and hardware
235
2
Jul 13, 2026
Jun 22
Keywords Studios
CA
Software and games
128
1
Aug 22, 2026
Jun 18
Uber
CA
Internet and platforms
29
3
Aug 3, 2026
Jun 15
Uber
CA
Internet and platforms
3
1
Aug 11, 2026
Jun 10
ServiceNow
CA
Software and games
117
2
Aug 17, 2026
Jun 10
Ubisoft
CA
Software and games
93
1
Aug 10, 2026
Jun 10
Veritone
CA
Software and games
31
1
Aug 10, 2026
Jun 8
Salesforce
CA
Software and games
86
1
Aug 7, 2026
Jun 4
Quizlet
CA
Internet and platforms
79
1
Jun 5, 2026
May 26
Meta
CA
Internet and platforms
2,599
3
Jul 22, 2026
May 26
Servatron
WA
Chips and hardware
124
1
Dec 31, 2026
May 22
Meta
WA
Internet and platforms
1,395
1
Jul 22, 2026
May 22
Meta
CA
Internet and platforms
671
3
Jul 22, 2026
May 21
Intuit
CA
Software and games
417
3
Jul 31, 2026
May 21
NetApp
CA
Chips and hardware
77
1
Jul 18, 2026
May 20
Intuit
CA
Software and games
493
1
Jul 31, 2026
May 20
Credit Karma
CA
Internet and platforms
117
1
Jul 31, 2026
May 15
LinkedIn
CA
Internet and platforms
606
5
Jul 13, 2026
May 8
Cloudflare
CA
Software and games
224
1
May 15, 2026
Apr 27
Apple
CA
Chips and hardware
57
1
Jun 24, 2026
Apr 23
Epic Games
CA
Software and games
135
5
Mar 27, 2026
Apr 16
Snap
CA
Internet and platforms
73
1
Apr 16, 2026
Apr 15
Snap
CA
Internet and platforms
247
1
Apr 16, 2026
Apr 15
Snap
WA
Internet and platforms
95
1
Apr 16, 2026
Apr 10
eBay
CA
Internet and platforms
198
1
Sep 30, 2026
Apr 9
Qualcomm
CA
Chips and hardware
38
9
Jun 8, 2026
Apr 2
Oracle
CA
Software and games
702
4
Jun 1, 2026
Apr 2
Qualcomm
CA
Chips and hardware
67
11
May 26, 2026
Apr 2
Oracle
NY
Software and games
62
1
Jul 1, 2026
Apr 1
Meta
CA
Internet and platforms
198
2
May 22, 2026
Mar 31
Oracle
WA
Software and games
475
1
Jun 1, 2026
Mar 31
Meta
WA
Internet and platforms
168
1
May 8, 2026
Mar 24
Epic Games
WA
Software and games
82
1
Mar 27, 2026
Mar 23
Synopsys
CA
Software and games
55
1
May 26, 2026
Mar 17
Dice and NeuLion
NY
Software and games
44
2
Jun 15, 2026
Mar 12
Atlassian
CA
Software and games
252
1
Mar 13, 2026
Mar 11
Atlassian
WA
Software and games
63
1
Mar 13, 2026
Mar 5
C2 Technologies
WA
IT services
1
1
Mar 6, 2026
Mar 3
Salesforce
CA
Software and games
51
1
May 1, 2026
Feb 25
eBay
CA
Internet and platforms
271
2
Feb 25, 2026
Feb 25
Riot Games
CA
Software and games
26
1
Apr 27, 2026
Feb 23
C3.ai
CA
Software and games
71
1
Apr 26, 2026
Feb 10
Clari
CA
Software and games
76
1
Apr 11, 2026
Feb 10
Riot Games
CA
Software and games
56
1
Apr 10, 2026
Feb 5
Workday
CA
Software and games
154
1
Apr 6, 2026
Feb 3
Meta
CA
Internet and platforms
102
6
Mar 20, 2026
Feb 3
Western Digital
CA
Chips and hardware
47
1
Jan 27, 2026
Feb 2
Intrepid Studios
CA
Software and games
123
1
Feb 2, 2026
Jan 30
Amazon (corporate offices)
WA
Internet and platforms
2,198
1
Apr 28, 2026
Jan 30
Amazon (corporate offices)
CA
Internet and platforms
1,025
27
Apr 28, 2026
Jan 28
Amazon (corporate offices)
WA
Internet and platforms
401
1
Apr 28, 2026
Jan 28
Expedia
WA
Internet and platforms
162
1
Apr 1, 2026
Jan 28
Amazon (corporate offices)
NY
Internet and platforms
135
1
Apr 28, 2026
Jan 28
Pinterest
CA
Internet and platforms
118
3
Mar 31, 2026
Jan 27
Google
CA
Internet and platforms
77
7
Mar 15, 2026
Jan 23
Autodesk
CA
Software and games
104
1
Apr 1, 2026
Jan 21
Meta
CA
Internet and platforms
272
2
Mar 20, 2026
Jan 21
Western Digital
CA
Chips and hardware
87
1
Jan 20, 2026
Jan 20
Vimeo
NY
Internet and platforms
133
1
Apr 20, 2026
Jan 19
Meta
WA
Internet and platforms
331
1
Mar 20, 2026
Jan 16
UKG
CA
Software and games
209
1
Mar 16, 2026
Jan 16
GCOM Software (Voyatek)
CA
IT services
8
1
Mar 20, 2026
Jan 14
Informatica
CA
Software and games
35
1
Feb 28, 2026
Jan 6
FormFactor
CA
Chips and hardware
220
2
Jan 30, 2026
Filed is the date the state received the notice (California, Washington) or the notice date (New York). Separations begin is the earliest effective or layoff start date the notice gives.
What WARN data can and cannot tell you
WARN notices are legal filings, so they carry names, sites, dates and worker counts that press tallies often lack. They also have hard limits. A notice is required only for large layoffs: in California, at employers with 75 or more workers when 50 or more are laid off at a site within 30 days; in Washington, 50 or more full-time workers at one site; in New York, at employers with 50 or more full-time staff when 25 or more lose jobs at a site (or 250 or more), with 90 days’ notice. Smaller cuts, rolling performance exits and layoffs in other states are invisible here. This tracker covers three states only and is not a national total.
Frequently asked questions
How many tech layoffs have there been in 2026?
In California, Washington and New York, WARN notices filed from January to September 2026 name 23,178 workers at 61 tech employers, up from 11,609 in the same months of 2025. WARN covers only large site-level layoffs in states that publish notices, so this is a floor, not a national count.
Which companies are doing layoffs in 2026?
By workers named in 2026 WARN notices in the three states, the largest tech filers are Meta (5,736), Amazon (4,085), Oracle (2,039). Together Meta and Amazon’s corporate offices account for 42% of all tech workers in 2026 notices so far.
Are tech layoffs worse in 2026 than in 2025?
Yes, in the WARN record. Tech workers in notices rose 100% from January to September, while layoffs at all other employers in the same notices fell 23%. Tech’s share of all WARN workers rose from 10.8% to 23.9%.
Will tech layoffs continue in 2026?
Some already are scheduled. Notices on file at October 13 list 3,364 tech workers at 15 employers with separation dates after October 7. September 2026 notices named 2,242 tech workers, against 1,316 in September 2025.
Who is laying off 30,000 employees?
WARN data cannot confirm a company-wide figure. What the legal record shows: Amazon’s corporate office notices in California, Washington and New York cover 8,299 workers from October 2025 through October 2026, the largest of any tech employer in that span.
Are IT services companies and MSPs laying off staff?
Rarely at WARN scale. IT services employers account for 33 of the 23,178 tech workers in January to September 2026 notices (0.1%), across 3 notices. Most layoffs at small firms fall below the 50-worker site threshold that triggers a notice in California and Washington.
Sources. California Employment Development Department WARN reports (fiscal year July 2024 to June 2025 and July 2025 to June 2026 as PDF, and the current WARN report spreadsheet, processed dates July 1 to October 7, 2026); Washington Employment Security Department WARN database (every notice received from September 2024 to October 2026); New York Department of Labor WARN dashboard, exported for notice years 2024 to 2026 with its industry tags. All retrieved October 13, 2026. Our parse of California’s PDFs reproduces EDD’s own monthly totals of notices and employees exactly for all 24 months.
Dates. California and Washington: the date the state received the notice. New York: the date on the notice, because New York’s posted date runs weeks to months behind and would move 2025 notices into 2026. Like-for-like comparisons use January 1 to September 30 of each year. Recent New York weeks are incomplete until the state posts them.
Counting. Workers are summed as listed on each notice. California lists one row per site; these are added together per employer and filing date. Duplicate rows (the same notice processed twice in California, or re-posted after amendment in New York, where we keep the latest version) are removed. Rescinded New York notices are excluded.
Definition of tech. An employer counts as tech only if its name matches our published list below, sorted into four groups. Internet and platforms: consumer internet, marketplaces, online education and consumer fintech apps. Software and games: software, cloud and security vendors, plus video game studios. Chips and hardware: semiconductors, chip equipment and test, computers, storage and networking hardware, and electronics contract manufacturers. IT services: IT consulting, systems integration, IT staffing and managed services. Excluded by rule: telecom carriers (T-Mobile, Verizon, AT&T), vehicle and autonomous driving companies (including Cruise and Lucid), biotech and medical devices, film and TV studios, payment networks and banks, and call center outsourcers. Amazon counts only for corporate office sites; Amazon Fresh stores, Amazon warehouses and delivery sites are excluded. Employers we could not identify were left out. As a check, California’s current file carries an industry code: 84% of workers in its Information sector (NAICS 51) notices are at employers on our list, and the rest are cinemas and film studios.
Coverage and exclusions. Three states with complete, machine-readable notice files. Texas was left out because its open-data copy of WARN notices stops in June 2026 and the Texas Workforce Commission’s own file could not be retrieved. A notice is a plan: some layoffs are later reduced, delayed or rescinded, and some workers are rehired. A worker counted in a notice may also be a contractor’s employee at a tech site, depending on who filed.
Not advice. This is an analysis of public filings, not employment or legal advice.
Cite as:The Uptime Report. "Tech Layoffs 2026: WARN Notices Show Tech Job Cuts Doubled While Other Layoffs Fell." October 2026. https://theuptimereport.com/tech-layoffs-2026/
Data Centers by State: Virginia Holds 1 in 5 Mapped Sites, and Its Commercial Power Use Jumped 60% Since 2019
Data centers by state, counted from public data: Virginia has 239 of the 1,207 data center sites mapped in the Pacific Northwest National Laboratory’s Open Source Data Center Atlas, about 1 in 5, followed by Texas (117) and California (109). Virginia’s commercial electricity sales rose 60% from 2019 to 2025, against 10% nationally (EIA).
239Virginia: mapped data center sites
117Texas: mapped data center sites
109California: mapped data center sites
97Oregon: mapped data center sites
74Ohio: mapped data center sites
There is no official government count of data centers by state, and private trackers each use their own definitions. We combined three public sources and kept their numbers separate, because they measure different things:
Mapped data center sitesFacilities in PNNL’s atlas, built from OpenStreetMap. We merged overlapping layers so a campus and the buildings inside it count once. Crowd-sourced, so it undercounts.
NAICS 518210 establishmentsCensus County Business Patterns locations of hosting, data processing, and computing infrastructure businesses, including offices. Not buildings.
Commercial electricity salesEIA retail sales to the commercial sector, where EIA has tied recent growth to data centers and other large computing facilities. Includes every office, store, and school too.
Map: mapped data center sites by state
Data center sites in the PNNL Open Source Data Center Atlas, by state
01 to 45 to 1415 to 3940 to 99100+
Each hexagon is one state (equal size, not to scale). Atlas version of 9 February 2026, 1,474 mapped features merged into 1,207 sites. Hover for the Census establishment count.
The concentration is sharp. The top five states hold 636 sites, 53% of the national total, and Virginia alone has more mapped sites than Texas and California combined. By building footprint the lead is similar: Virginia has 41.8 million of the 191 million square feet of data center buildings traced in the atlas (22%). Five states have no mapped site at all. Our broader data center statistics report covers national electricity use and construction spending.
State league table
All 50 states and DC, ranked by mapped data center sites. Census and EIA columns are independent measures, so a state can rank high on one and low on another.
#
State
Mapped sites
Mapped features
Building footprint (M sq ft)
NAICS 518210 establishments, 2023
Employees, 2023
Employee change, 2019 to 2023
Average pay
Commercial power, 2025 (TWh)
Commercial power change, 2019 to 2025
1
Virginia
239
319
41.78
641
33,404
+39%
$145k
86.6
+60.5%
2
Texas
117
127
18.89
1,412
56,290
+9%
$124k
174.7
+23.0%
3
California
109
112
7.29
2,698
123,859
+33%
$211k
114.2
-0.1%
4
Oregon
97
109
17.13
231
6,706
+1%
$111k
29.8
+81.3%
5
Ohio
74
91
15.37
633
14,692
+7%
$112k
57.7
+25.5%
6
Arizona
58
65
9.53
337
14,607
+41%
$94k
37.6
+27.9%
7
Washington
52
82
7.88
476
14,485
-13%
$201k
33.3
+13.8%
8
New Jersey
49
53
6.54
595
18,632
+13%
$140k
37.0
-2.6%
9
Illinois
44
50
7.32
627
21,934
+2%
$120k
46.4
-5.9%
10
Iowa
39
63
11.91
126
3,900
-45%
$80k
13.6
+10.7%
11
Nevada
36
38
5.24
204
3,419
+13%
$104k
14.3
+22.1%
12
Georgia
31
37
6.62
567
26,230
+48%
$120k
57.1
+20.5%
13
Colorado
20
20
1.46
554
17,689
+4%
$135k
20.9
-0.8%
14
New York
20
21
1.21
1,013
39,730
+13%
$247k
72.2
-3.9%
15
Nebraska
18
26
5.39
124
6,313
+49%
$112k
15.0
+58.4%
16
North Carolina
17
23
2.25
450
17,241
+7%
$112k
50.2
+2.1%
17
Tennessee
15
22
4.74
248
8,802
+79%
$78k
36.5
+0.9%
18
Florida
15
16
0.59
1,266
30,385
+10%
$122k
100.4
+3.9%
19
Missouri
13
15
1.50
265
7,389
-21%
$101k
30.4
+0.8%
20
Maryland
13
13
0.52
448
13,631
+16%
$111k
27.7
-4.1%
21
Wisconsin
13
13
0.17
186
5,998
-22%
$94k
23.7
+0.8%
22
New Mexico
11
16
3.32
77
943
+22%
$92k
9.4
+3.9%
23
Utah
10
15
2.77
268
9,239
+9%
$122k
14.8
+24.4%
24
Michigan
10
10
0.27
455
10,198
-9%
$104k
37.3
-1.4%
25
Minnesota
9
11
1.25
291
15,633
+32%
$127k
22.8
-0.4%
26
Pennsylvania
9
9
0.61
937
19,443
+2%
$113k
40.3
+0.4%
27
Kansas
7
7
0.57
146
3,679
+3%
$118k
16.2
+2.1%
28
Alabama
6
11
2.12
152
3,588
-2%
$75k
22.8
-1.0%
29
Wyoming
6
19
1.16
59
292
-2%
$100k
5.6
+58.0%
30
Oklahoma
6
6
0.55
161
3,296
-20%
$77k
27.3
+36.1%
31
Connecticut
5
5
0.28
211
4,962
-10%
$142k
11.6
-4.3%
32
Indiana
5
5
0.23
258
4,977
-37%
$93k
25.6
+9.0%
33
Kentucky
5
5
0.09
441
6,971
-7%
$64k
20.8
+6.0%
34
South Carolina
3
12
2.21
186
3,727
-28%
$101k
26.5
+19.4%
35
Idaho
3
5
0.71
108
2,002
-28%
$101k
7.1
+10.1%
36
Massachusetts
3
3
0.31
510
27,905
+45%
$167k
24.4
-3.6%
37
New Hampshire
3
3
0.05
94
3,418
+17%
$139k
4.2
-1.2%
38
Mississippi
2
2
0.81
74
1,621
-16%
$62k
14.4
+0.9%
39
South Dakota
2
2
0.30
53
425
-14%
$72k
5.5
+12.2%
40
Maine
2
2
0.06
64
1,840
+22%
$83k
4.1
-1.9%
41
Arkansas
2
2
0.04
129
6,131
+19%
$90k
11.9
0.0%
42
North Dakota
2
2
0.03
32
234
-53%
$67k
11.5
+63.3%
43
Montana
2
2
0.01
58
701
-16%
$83k
5.1
+3.5%
44
District of Columbia
1
1
0.00
119
3,494
+47%
$121k
7.2
-9.1%
45
Louisiana
1
1
0.00
130
2,884
+5%
$64k
24.0
-1.2%
46
West Virginia
1
1
0.00
45
461
-60%
$54k
8.0
+5.9%
47
Alaska
0
0
0.00
33
1,074
+77%
$76k
2.6
-1.6%
48
Delaware
0
0
0.00
206
1,743
+81%
$157k
4.3
-3.2%
49
Hawaii
0
0
0.00
59
528
-18%
$98k
2.8
-7.6%
50
Rhode Island
0
0
0.00
46
488
+1%
$96k
3.7
+0.2%
51
Vermont
0
0
0.00
41
2,294
-22%
$165k
2.0
+2.9%
Mapped features counts every point, building, and campus object in the atlas; mapped sites removes buildings and points that fall inside a mapped campus (and points inside a mapped building). Employment is mid-March. Average pay is annual payroll divided by employees.
The top five data center states
#1
Virginia
239 mapped sites (19.8% of US)
Building footprint mapped
41.8M sq ft
Top county
Loudoun County (144)
Most-mapped operators
Amazon Web Services (73), Equinix (17), Digital Realty (16)
NAICS 518210, 2023
641 est., 33,404 jobs
Commercial power, 2019 to 2025
54.0 to 86.6 TWh (+60.5%)
Jan to Jul 2026 vs 2025
+6.6%
#2
Texas
117 mapped sites (9.7% of US)
Building footprint mapped
18.9M sq ft
Top county
Bexar County (28)
Most-mapped operators
Microsoft (8), Digital Realty (7), CyrusOne (5)
NAICS 518210, 2023
1,412 est., 56,290 jobs
Commercial power, 2019 to 2025
142.0 to 174.7 TWh (+23.0%)
Jan to Jul 2026 vs 2025
+7.0%
#3
California
109 mapped sites (9.0% of US)
Building footprint mapped
7.3M sq ft
Top county
Santa Clara County (74)
Most-mapped operators
Digital Realty (14), Equinix (13), CoreSite (8)
NAICS 518210, 2023
2,698 est., 123,859 jobs
Commercial power, 2019 to 2025
114.3 to 114.2 TWh (-0.1%)
Jan to Jul 2026 vs 2025
-1.3%
#4
Oregon
97 mapped sites (8.0% of US)
Building footprint mapped
17.1M sq ft
Top county
Umatilla County (31)
Most-mapped operators
Amazon Web Services (51), Quality Technology Services (7), Flexential (7)
NAICS 518210, 2023
231 est., 6,706 jobs
Commercial power, 2019 to 2025
16.4 to 29.8 TWh (+81.3%)
Jan to Jul 2026 vs 2025
+5.7%
#5
Ohio
74 mapped sites (6.1% of US)
Building footprint mapped
15.4M sq ft
Top county
Licking County (25)
Most-mapped operators
Amazon Web Services (32), Meta (5), Quality Technology Services (4)
NAICS 518210, 2023
633 est., 14,692 jobs
Commercial power, 2019 to 2025
46.0 to 57.7 TWh (+25.5%)
Jan to Jul 2026 vs 2025
+15.3%
Operators are as tagged in OpenStreetMap and counted by site. January to July 2026 comparison uses preliminary EIA-861M monthly commercial sales.
Where commercial electricity demand grew
EIA does not publish data center electricity use by state, but data center load shows up in commercial retail sales. From 2019 to 2025, US commercial sales rose 142 TWh. Texas (+32.7 TWh) and Virginia (+32.6 TWh) added almost the same amount, and together they account for 42% of the growth in the 32 states where commercial sales increased. Five states grew 50% or more: Oregon (+81%), North Dakota (+63%), Virginia (+60%), Nebraska (+58%), Wyoming (+58%).
Largest increases in commercial electricity sales, 2019 to 2025
EIA-861 annual retail sales, commercial sector, all providers. 2025 values from the file updated 7 October 2026.
Mapped data centers and power growth line up only loosely. Across all states, the rank correlation between mapped sites and percentage growth in commercial sales is 0.35. North Dakota is the clearest outlier: commercial sales up 63% with only 2 mapped sites. EIA has attributed North Dakota’s growth to large computing facilities, which OpenStreetMap barely records. In the other direction, California has 109 mapped sites, yet its commercial sales were essentially flat (-0.1%).
Facilities are not establishments
The Census industry count tells a different story from the map. California has 2,698 NAICS 518210 establishments and 20% of the industry’s 629,527 employees, but only 9% of mapped sites. Virginia ranks 4th for industry employment. Industry jobs follow company offices. Facility siting follows other factors, which EIA describes for Virginia as fiber connectivity, land availability, and power infrastructure. For the full Census picture of IT businesses, see our IT services firms by state atlas.
Share of US mapped sites vs share of NAICS 518210 employees, top 10 states by sites
share of mapped data center sites share of NAICS 518210 employees (2023)
Counties with the most data centers
#
County
State
Mapped sites
1
Loudoun County
Virginia
144
2
Santa Clara County
California
74
3
Maricopa County
Arizona
56
4
Prince William County
Virginia
55
5
Umatilla County
Oregon
31
6
Bexar County
Texas
28
7
Morrow County
Oregon
28
8
Cook County
Illinois
26
9
Washington County
Oregon
26
10
Fairfax County
Virginia
26
The largest mapped data center campuses
Ranked by the land area of the campus outline in OpenStreetMap. Meta and Google operate most of the named campuses on this list. None of the ten is in Virginia, even though it has 31 mapped campuses. Campus land area measures the site, not its power capacity.
#
Name in OSM
Operator
Location
Acres
1
Google Montgomery Data Center
Google LLC
Montgomery County, TN
611
2
Altoona Meta Data Center
Meta
Polk County, IA
610
3
Meta Eagle Mountain Data Center
Utah County, UT
522
4
Google Data Center
Google
Franklin County, OH
521
5
Meta Los Lunas Data Center
Meta
Valencia County, NM
501
6
Meta Bowling Green Data Center
Wood County, OH
494
7
(no name in OSM)
Douglas County, NE
492
8
Meta Beaver Dam Data Center
Meta
Dodge County, WI
419
9
Meta Prineville Datacenter
Meta
Crook County, OR
399
10
Gallatin Data Center
Meta
Sumner County, TN
391
What this means for MSPs
For MSPs choosing colocation, the map is a shortlist: Virginia, Texas, California, Oregon, Ohio, Arizona, Washington, and New Jersey have the most mapped sites. Check the power story before you sign. In states where commercial load has grown fastest, such as Virginia and Oregon, ask a provider how much utility power is contracted for its expansion and when it arrives. For staffing, the Census numbers point somewhere else: hosting and infrastructure jobs are concentrated in California, Texas, New York, and Virginia, where MSPs recruit against large employers. If a client asks whether its state “has data centers”, the answer from the Census data is yes in every state, but mapped data center supply is concentrated in a short list.
Frequently asked questions
What US state has the most data centers?
Virginia. It has 239 of the 1,207 data center sites mapped in PNNL’s Open Source Data Center Atlas (20%), and 22% of all mapped data center building footprint. Texas (117), California (109), Oregon (97), and Ohio (74) follow.
Do all 50 states have data centers?
Every state and DC has establishments in the Census hosting and data processing industry (NAICS 518210); the smallest count in 2023 was 32. In the OpenStreetMap-based PNNL atlas, five states (Alaska, Delaware, Hawaii, Rhode Island, Vermont) have no mapped data center yet, which reflects mapping coverage rather than proof that none exist.
What are the largest data centers in the US by land area?
Among campuses mapped in the PNNL atlas, the largest outlines are Google Montgomery Data Center in Tennessee (611 acres), Altoona Meta Data Center in Iowa (610 acres), and Meta Eagle Mountain Data Center in Utah (522 acres). Land area is not the same as power capacity.
Which states use the most electricity for data centers?
No federal series reports data center electricity by state. The closest signal is commercial electricity sales: from 2019 to 2025, Texas added 32.7 TWh and Virginia 32.6 TWh, together 42% of all growth in states where commercial sales rose. Oregon grew fastest in percentage terms, up 81%.
How many data center companies are there in each state?
Census counted 18,544 establishments in NAICS 518210 in 2023. California had the most (2,698), followed by Texas (1,412). Establishments are business locations, including offices, not data center buildings.
Mapped sites. PNNL IM3 Open Source Data Center Atlas, version v2026.02.09 (doi:10.57931/3017294), GeoPackage downloaded from the atlas repository in October 2026. The atlas has three layers derived from OpenStreetMap: 132 campuses, 1,237 buildings, and 105 points (1,474 unique features). Because a campus and its buildings can both appear, we counted each campus once, dropped 255 buildings whose centroid falls inside a mapped campus, and dropped 12 points inside a mapped campus or building, leaving 1,207 sites. Buildings on a campus that has no campus outline still count separately, so the site count leans toward a building count in states mapped building by building. Building footprint sums the building layer’s polygon area (one floor, not total floor space). OpenStreetMap is crowd-sourced and incomplete.
Establishments. U.S. Census Bureau, County Business Patterns, state files 2019 to 2023, NAICS 518210 (computing infrastructure providers, data processing, web hosting, and related services), all legal forms. No state values were suppressed; Census noise flags (G low, H medium, J high) are in the CSV.
Electricity. U.S. Energy Information Administration, EIA-861 historical state retail sales (file updated 7 October 2026), commercial sector, total electric industry. Latest-month comparison uses EIA-861M (preliminary) through July 2026. Commercial sales include all commercial customers, and EIA does not identify which customers are data centers, so this is a proxy.
Limitations. None of these sources is a complete count of data centers. Use the mapped site count for the geography of physical facilities, the Census count for the industry’s business footprint, and EIA sales for the power trend.
Cite as:The Uptime Report. "Data Centers by State: Virginia Holds 1 in 5 Mapped Sites, and Its Commercial Power Use Jumped 60% Since 2019." October 2026. https://theuptimereport.com/data-centers-by-state-2026/
Uptime Report Research · Energy and Infrastructure
Data Center Statistics 2026: Power Use Rose 100 TWh While US Demand Rose 8, and Construction Hit $85 Billion
Data center statistics usually come from vendor estimates. We pulled the federal series instead. US data centers used 176 TWh of electricity in 2023, 4.4% of the national total, up from 1.9% in 2018 (Lawrence Berkeley National Laboratory). Private data center construction reached a $85.0 billion annual rate in August 2026 (Census Bureau), up 73% in a year.
20 GWaverage round-the-clock draw of all US data centers, 2023
12xTWh added by data centers vs by all US electricity use, 2018 to 2023
629,527employees in NAICS 518210, 2023 (Census CBP)
66B literswater consumed on site by US data centers, 2023 (LBNL)
How much electricity do data centers use?
Lawrence Berkeley National Laboratory’s December 2024 report for the Department of Energy is the most detailed public estimate of US data center electricity use. It puts consumption at about 60 TWh a year from 2014 to 2016, 76 TWh in 2018, and 176 TWh in 2023. We divided each year by the Energy Information Administration’s total US electricity end use to get the share, which reproduces LBNL’s own 1.9% for 2018 and 4.4% for 2023.
Data center share of US electricity use, 2014 to 2023, and the 2028 scenario range
Solid dots: values stated in the LBNL text (2018, 2023). Open dots: annual values read from LBNL Figure ES-1 (accurate to about 2 TWh). Denominator: EIA total electricity end use (retail sales plus direct use). The 2028 range uses LBNL’s stated shares.
The share more than doubled in five years. Data center use rose by about 100 TWh between 2018 and 2023. Over the same years, total US electricity end use rose by just 8 TWh, from 4,003 to 4,011 TWh. Data centers added about 12 times as many TWh as the whole country did, so everything else, taken together, used less: US end use excluding data centers fell from 3,927 to 3,835 TWh. Year-to-year totals move with weather, so we checked a second start year. From 2019, data centers added about 87 TWh against 57 TWh for the national total.
Data center power consumption in gigawatts and households
176 TWh a year is an average load of about 20.1 GW, running every hour of the year, or about 482 GWh per day. It equals 12% of all electricity that US households bought from utilities in 2023 (1,450 TWh). LBNL’s scenarios for 2028 range from 325 to 580 TWh. At an assumed 50% average capacity utilization, LBNL translates that into 74 to 132 GW of total power demand, and 6.7% to 12.0% of forecast US electricity consumption.
Why the range is so wide. LBNL varies three things for 2028: how many AI GPUs are shipped, how hard the installed servers run, and which cooling systems new facilities use. The high case is almost 1.8 times the low case, so treat any single 2028 number as one scenario, not a forecast.
The latest national data show demand still rising. EIA’s total US electricity end use reached 4,195 TWh in 2025, up 184 TWh from 2023, and the first six months of 2026 were 1.1% above the same months of 2025. EIA does not break out data centers in these totals, so the share of that growth due to data centers is not measured directly. Our data centers by state report shows where commercial electricity sales grew fastest since 2019.
Data center construction spending
The Census Bureau has tracked private data center construction as its own category since 2014 (it was folded into general office before that). Spending rose from $1.8 billion in 2014 to $49.7 billion in 2025, about 28 times as much. From January to August 2026, Census counts $45.2 billion, 42% more than the same months of 2025 ($31.9 billion) and already 91% of the full 2025 total.
Private data center construction put in place, by year (billions of dollars)
2014 to 2022 2023 to 2025 2026, January to August only
*2026 is a partial year (January to August, not seasonally adjusted; August is preliminary). Annual values are sums of Census monthly estimates and match the Census annual table.
On a seasonally adjusted annual rate basis, data center construction passed general office buildings for the first time in April 2025, fell back below for four months, and has stayed above it every month since September 2025. By August 2026 it ran at $85.0 billion a year against $45.8 billion for general office, and it was larger than private health care construction ($57.0 billion) and lodging ($23.3 billion). Data centers now account for 11.0% of all private nonresidential construction.
Monthly construction spending, seasonally adjusted annual rate
Census Value of Construction Put in Place, private. General office excludes data centers and financial buildings. Recent months are revised in later releases.
Data center jobs and employers
The closest federal employment series is the Census County Business Patterns count for NAICS 518210, now titled computing infrastructure providers, data processing, web hosting, and related services. In 2023 it had 18,544 establishments, 629,527 employees, and $93.0 billion in annual payroll. Since 2019, employment grew 13.9% and payroll grew 49.3%, while establishments grew only 7.2%, so the industry is adding staff and pay faster than locations. Average pay was $147,665, 2.2 times the $68,342 average across all industries in the same Census file. For the wider IT services picture, see how hosting revenue outgrew the rest of IT services.
Year
Establishments
Employees (mid-March)
Annual payroll
Average pay
2012
13,950
436,253
$39.1B
$89,694
2013
14,276
488,879
$43.0B
$87,997
2014
13,903
526,302
$48.2B
$91,541
2015
13,599
539,171
$50.9B
$94,443
2016
13,566
462,391
$44.1B
$95,285
2017
17,597
525,528
$53.8B
$102,369
2018
17,526
546,889
$57.7B
$105,486
2019
17,297
552,937
$62.3B
$112,596
2020
17,273
557,409
$67.0B
$120,284
2021
17,297
552,789
$83.9B
$151,831
2022
17,539
570,188
$83.2B
$145,906
2023
18,544
629,527
$93.0B
$147,665
NAICS 518210 is not a count of data center buildings. It covers establishments whose main activity is hosting, data processing, or providing computing infrastructure, including offices. Data centers owned by companies in other industries (for example, a retailer’s own facility) are counted in the owner’s industry. The jump between 2016 and 2017 (13,566 to 17,597 establishments) appears in the Census files without a code change, so compare years from 2017 on.
Efficiency and water
LBNL estimates the national average power usage effectiveness (PUE, total facility power divided by IT equipment power) fell from 1.6 in 2014 to 1.4 in 2023, mainly because more servers moved into large hyperscale and colocation facilities. Infrastructure such as cooling fell from about 40% of data center electricity in 2014 to 30% in 2023. Direct water use rose from 21.2 billion liters in 2014 to 66 billion liters in 2023 (about 17.4 billion US gallons), and LBNL projects hyperscale facilities alone could use 60 to 124 billion liters in 2028.
Data center statistics at a glance, year by year
Year
Data center electricity (TWh, LBNL)
Share of US end use
US electricity end use (TWh, EIA)
Private data center construction
NAICS 518210 establishments
Employees
Payroll
2014
~60
1.5%
3,903
$1.8B
13,903
526,302
$48.2B
2015
~61
1.6%
3,900
$2.7B
13,599
539,171
$50.9B
2016
~64
1.6%
3,902
$4.1B
13,566
462,391
$44.1B
2017
~70
1.8%
3,864
$4.7B
17,597
525,528
$53.8B
2018
76
1.9%
4,003
$6.9B
17,526
546,889
$57.7B
2019
~89
2.3%
3,954
$8.5B
17,297
552,937
$62.3B
2020
~106
2.7%
3,856
$9.2B
17,273
557,409
$67.0B
2021
~128
3.2%
3,945
$9.9B
17,297
552,789
$83.9B
2022
~151
3.7%
4,067
$12.6B
17,539
570,188
$83.2B
2023
176
4.4%
4,011
$20.0B
18,544
629,527
$93.0B
2024
4,110
$34.8B
2025
4,195
$49.7B
2028 scenario
325 to 580
6.7% to 12.0%
~ marks values read from LBNL Figure ES-1. LBNL publishes no single-year estimates for 2024 to 2027, only a scenario band. CBP data end in 2023.
What this means for MSPs
The server room is losing share. LBNL estimates about 75% of US servers sat in hyperscale and colocation facilities by 2023, and construction at an $85 billion annual rate adds more of that capacity every month. That supports moving client workloads out of closets and into colocation or cloud, with the MSP managing the stack rather than the room. Power is the constraint to check: before signing a multi-year colocation contract, ask the provider what utility capacity is committed for its expansion, especially in the states where commercial electricity sales have grown fastest. For clients who keep equipment on site, LBNL attributes most of the national PUE gain to the move into large facilities and notes that real systems rarely perform as well as their design, which makes small rooms a reasonable target for consolidation projects. Hiring is the last pressure point. Employers in NAICS 518210 paid $148k on average in 2023, more than double the all-industry figure, and MSPs hiring infrastructure technicians compete with them; our MSP industry statistics track pay at managed IT firms.
Frequently asked questions
How much electricity do data centers use in the US?
US data centers used about 176 TWh in 2023, or 4.4% of all electricity consumed in the country, according to Lawrence Berkeley National Laboratory. That is an average draw of about 20 gigawatts around the clock, and equal to 12% of what every US home bought from utilities that year.
Does the US have enough electricity for data centers?
Data center use rose by about 100 TWh from 2018 to 2023 while total US electricity end use rose by only 8 TWh, so other uses fell to make room. LBNL’s scenarios put data centers at 325 to 580 TWh in 2028, or 6.7% to 12.0% of US demand, which would require 74 to 132 GW of power.
How much power does a data center use per day?
Across all US data centers, 176 TWh a year works out to about 482 gigawatt hours per day in 2023. No federal source reports electricity use facility by facility, so per-site figures in circulation are estimates.
How much is being spent to build data centers?
Private data center construction was $49.7 billion in 2025, up from $1.8 billion in 2014, according to the Census Bureau. In August 2026 the seasonally adjusted annual rate reached $85.0 billion, 11% of all private nonresidential construction.
How many people work in data centers?
The Census industry that covers data processing, hosting, and computing infrastructure providers (NAICS 518210) had 629,527 employees at 18,544 establishments in 2023, with average pay of $147,665. That industry also includes hosting and data processing offices, and some company-owned data centers are counted under their parent’s industry.
How many data centers are there in each state?
Federal statistics do not publish an official count of data center buildings. Our companion report on data centers by state combines a PNNL map of data center facilities with Census establishment counts and EIA electricity sales for all 50 states.
Electricity. Lawrence Berkeley National Laboratory, 2024 United States Data Center Energy Usage Report (Shehabi et al., LBNL-2001637, December 2024), retrieved October 2026. Values for 2018, 2023, and 2028 come from the report text, which also gives about 60 TWh a year for 2014 to 2016. Values for 2014 to 2017 and 2019 to 2022 in our table were read from Figure ES-1 (Figure 5.5) by measuring the pixel position of the line against the chart axes; the method reproduces the stated values within about 1.5 TWh (it reads 77 TWh for 2018, where the text says 76). Shares divide LBNL TWh by EIA total electricity end use (Monthly Energy Review Table 7.6, retail sales plus direct use), which reproduces LBNL’s 1.9% (2018) and 4.4% (2023).
Construction. U.S. Census Bureau, Value of Construction Put in Place (C30), private construction, data center category, monthly from January 2014 to August 2026 (release of October 1, 2026). Annual and year-to-date values sum the not seasonally adjusted monthly series; monthly comparisons use the seasonally adjusted annual rate. Before 2014 Census included data centers in general office. The last two months are preliminary or revised and will change.
Employment. U.S. Census Bureau, County Business Patterns national files, 2012 to 2023, NAICS 518210, all legal forms of organization. Employment is for the pay period including March 12. NAICS 518210 maps one to one between the 2017 and 2022 NAICS editions.
Limitations. No federal agency measures data center electricity use directly; LBNL’s estimate is a model built on server shipments, operating assumptions, and cooling simulations. EIA does not report data centers as a separate sector. Census construction values cover private projects only and are survey estimates with sampling error.
Not advice. This is an analysis of public statistics, not an investment or procurement recommendation.
Cite as:The Uptime Report. "Data Center Statistics 2026: Power Use Rose 100 TWh While US Demand Rose 8, and Construction Hit $85 Billion." October 2026. https://theuptimereport.com/data-center-statistics-2026/