Organizations cited an average dwell time of nearly 2 weeks for threat actors prior to a ransomware incident.

22.00% of ransomware incidents involved lateral movement and privilege escalation as the detected phase.

12.00% of ransomware incidents involved data exfiltration as the detected phase.

25.6% of government sector threats were attributed to Akira in 2024.

Qilin's activity marks a 318% YoY increase.

Only 37% of organizations said they are already investing in deepfake defense.

73% of respondents were 'very confident' in their organizations' defenses against deepfake attacks in 2025.

IncRansom's Q3 2025 victim count was 126 organizations and individuals.

In Q2 2025, there were 92 reports of ransomware attacks on healthcare organizations.

There were 1,576 total public posts related to ransomware victims (organizations and individuals) in Q3 2025.

Over 61% of organizations that have lost money in a deepfake attack reported losses in excess of $100,000.

SafePay impacted 71 organizations and individuals across 19 industries and 16 countries in Q3 2025.

Mean financial losses for organizations targeted by deepfake-related incidents stand at over $280,000.

99% of organizations say that deepfake defense will be important to their cybersecurity strategies over the next 12-18 months.

In Q2 2025, ransomware attacks on healthcare organizations accounted for 5.8% of all ransomware attacks.

Over 40% of organizations faced three or more deepfake attacks.

In Q3 2025, manufacturing organizations experienced a 26% increase in ransomware attacks.

Qilin recorded 234 victims (organizations and individuals) in Q3 2025.

56.00% of global ransomware victims (organizations and individuals) in Q3 2025 were from the United States.

Recorded audio/voice manipulations currently account for 52% of deepfake threat vectors.