In 2025, Cisco Talos reported multiple incidents related to Qilin ransomware.

In the second half of 2025, the Qilin ransomware group published victim information at a rate exceeding 40 cases per month.

About 10% of Qilin ransomware cases were related to wholesale trade.

Around 18% of Qilin ransomware cases impacted professional and scientific services.

The number of victims whose information was posted on the Qilin ransomware leak site peaked at 100 cases in June 2025.

Fewer than 25% of organizations that experienced a ransomware attack recovered from the attack within 24 hours.

Over 40% of organizations reported using AI or automation to support threat detection and alerting in response to a ransomware incident

37% of financial services organizations suffered significant disruption to business operations due to ransomware attacks.

In 2025, 70.4% of ransomware attacks, totaling 3,310 incidents, were distributed across other regions.

87% of organizations expect deepfakes to become major attack vectors in future ransomware campaigns.

82% of organizations believe generative AI makes phishing emails more difficult to identify, even for well-trained employees.

Manufacturing has been the #1 targeted industry for ransomware attacks for four consecutive years, according to the IBM X-Force 2025 Threat Intelligence Index.

In 2025, half of all ransomware attacks worldwide targeted essential sectors such as manufacturing, healthcare, energy, transportation, and finance, indicating a shift from opportunistic crime to systemic disruption.

In 2025, five countries accounted for 1,391 ransomware events, representing nearly 30% of all recorded ransomware attacks.

In 2025, 50% of all ransomware attacks are projected to target critical infrastructure, highlighting the urgent need for enhanced cyber resilience strategies.

89% of healthcare organizations express concern that deepfake audio and video will become major vectors for social engineering in future ransomware attacks.

76% of organizations reported that it is getting harder to be fully prepared for ransomware attacks

83% of organizations that paid ransoms were hit again by ransomware attacks

50% of organizations that experienced a ransomware attack believed they were 'very well prepared' for ransomware.

Between January and September 2025, KELA observed 4,701 ransomware incidents, representing a 34% year-over-year increase compared to the same period in 2024.