In 2025, ransomware events against critical industries increased by 34% compared to the previous year.

The top five ransomware groups — Qilin, Clop, Akira, Play, and SafePay — were responsible for 938 incidents, accounting for nearly 25% of all ransomware attacks in 2025.

In 2025, there were 103 distinct ransomware threat actors observed targeting critical infrastructure.

In 2025, 2,332 ransomware incidents targeted critical infrastructure, accounting for 50% of all incidents, compared to 1,745 incidents, which accounted for 54%, in 2024.

90% of C-level executives express concern that deepfake audio and video will become major vectors for social engineering in future ransomware attacks.

From January 1 to September 1, 2025, there were 4,701 recorded ransomware incidents, with 2,332 incidents (50%) targeting critical sectors such as manufacturing, healthcare, energy, transportation, and financial services.

From January 1 to September 1, 2024, there were 3,219 total recorded ransomware incidents, with 1,745 incidents (54%) targeting critical sectors.

Ransomware attacks against the manufacturing sector surged from 520 incidents in 2024 to 838 incidents in 2025, marking a 61% increase.

In 2025, the United States experienced 21.3% of all ransomware attacks, totaling approximately 1,000 incidents.

51% of organizations deployed automated incident response.

Ransomware attacks in the manufacturing sector surged by 61% from 520 incidents to 838 incidents year-over-year, marking the steepest growth among all sectors.

In 2025, the United States accounted for roughly 1,000 ransomware incidents targeting critical infrastructure, representing 21% of all global ransomware attacks.

In 2025, the United Kingdom experienced 76 ransomware incidents, accounting for 1.6% of all attacks.

In 2025, Italy experienced 74 ransomware incidents, representing 1.6% of all attacks.

48% of organizations adopted AI-enhanced phishing detection.

In 2025, Canada experienced 139 ransomware incidents, accounting for 3.0% of all attacks.

54% of healthcare organizations implemented AI-powered threat detection.

In 2025, 5.9% of ransomware attacks were attributed to Qilin, 5.9% to Clop, 5.0% to Akira, 2.9% to Play, and 2.7% to SafePay.

In 2025, Germany experienced 102 ransomware incidents, representing 2.2% of all attacks.

Qilin was responsible for 248 incidents, Clop for 246 incidents, Akira for 209 incidents, Play for 120 incidents, and SafePay for 115 incidents in 2025.