The percentage of respondents who were 'very concerned' about the threat deepfakes pose to their organizations increased by over 15% from last year.

Akira had 133 victims (organizations and individuals) in Q2 2025.

The emerging threat group 'The Gentlemen' posted 32 victims (organizations and individuals) on a single day once their data leak site went live in 2025.

2.35% of global ransomware victims (organizations and individuals) in Q3 2025 were from France.

Qilin claimed 10 healthcare organizations as victims in Q3 2025.

GLOBAL and BlackLock had four distinct names in a little over a year.

IncRansom, SafePay, and Qilin together accounted for 30% of the 118 healthcare organizations that were victims in Q3 2025.

There were 77 total ransomware groups active in Q3 2025.

2.79% of global ransomware victims (organizations and individuals) in Q3 2025 were from Canada.

2.03% of global ransomware victims (organizations and individuals) in Q3 2025 were from Spain.

Ransomware groups claimed 118 healthcare organizations as victims in Q3 2025.

During Q3 2025, Akira claimed one healthcare industry organization as a victim on their DLS.

The average number of public posts related to ransomware victims (organizations and individuals) per week in Q3 2025 was 121.

2.48% of global ransomware victims (organizations and individuals) in Q3 2025 were from the Republic of Korea.

Rhysida has claimed over 200 organizations and individuals as victims to their dark web DLS.

The 'The Gentlemen' group claimed 38 total victims (organizations and individuals) across the month of September 2025.

4.89% of global ransomware victims (organizations and individuals) in Q3 2025 were from Germany.

IncRansom had 62 victim claims (organizations and individuals) in Q2 2025.

GRIT observed 14 publicly disclosed ransomware attacks against state agencies, counties, and municipalities in Florida since July 2022.

94% of IT professionals expressed at least some level of concern about deepfake-related threats to their organizations.