Average initial ransom demand (based on all cases with ransom demand) in 2022: $21.46 million.

The average duration business operations were affected by ransomware in technology was 57 days.

In 35.7% of data breach cases prior to 2019, the company’s own IT team or outsourced service providers detected the attack.

The average duration business operations were affected by ransomware in other industries was 44 days.

For data breach cases where the attacker was detected by a third-party, it took an average of 136 days to notice the attacker prior 2019.

Financially motivated social engineering, particularly tailored attacks enhanced by AI-powered phishing content, fuelled a disproportionate share of incurred losses (88%).

The average cost of an individual ransomware attack rose by 17% in the first half of 2025.

Between 2019 and 2023, financial services experienced large losses primarily from data breaches (40.9%) and ransomware (40.9%), followed by other causes (18.2%).

Between 2019 and 2023, technology experienced large losses primarily from other causes (38.0%), followed by ransomware (32.0%) and data breaches (30.0%).

Healthcare experienced extortion demands as high as $4 million.

Just over half of organizations have centralized governance processes.

Targeted sectors by DDoS attack in the first half of 2025: Defense (23% - an increase of 14%), retail & e-commerce (18% - an increase of 8%), logistics & transport (15% - an increase of 9%), public sector (11%), education (9%), finance (6%), healthcare (5%), telco (5%), technology, IT, Internet (4%), and other (4%).

Healthcare, retail, and manufacturing remained the most targeted sectors.

The largest single email breach, affecting United Seating and Mobility, exposed over half a million records.

The sharp rise in Microsoft 365 email breaches in healthcare represents a 21% increase year-over-year.

The average healthcare email breach exposed nearly 16,000 individual records in the first half of 2025.

More than 1.6 million patient records were compromised across all analysed email-related healthcare incidents that occurred in the first half of 2025.

Incidents involving Mimecast email customers accounted for 8% in healthcare.

Incidents involving Barracuda email customers accounted for 5% in healthcare.

Incidents involving Proofpoint email customers accounted for 6% in healthcare.