2.60% of global ransomware victims (organizations and individuals) in Q3 2025 were from Italy.

1.46% of global ransomware victims (organizations and individuals) in Q3 2025 were from Brazil.

Toha personally profited over €7 million from trading malware, stolen data, and malicious access on his platform.

There were 77 total ransomware groups active in Q3 2025.

Ransomware attacks on healthcare organizations accounted for 7.5% of all ransomware attacks in Q3 2025.

1.33% of global ransomware victims (organizations and individuals) in Q3 2025 were from Australia.

One individual's death was directly tied to the Qilin ransomware attack on Synnovis in June 2024.

Qilin's activity marks a 318% YoY increase.

There was a 36% decrease in SafePay's impact on organizations and individuals quarter-over-quarter.

There were 1,576 total public posts related to ransomware victims (organizations and individuals) in Q3 2025.

The 'The Gentlemen' group claimed 38 total victims (organizations and individuals) across the month of September 2025.

IncRansom, SafePay, and Qilin together accounted for 30% of the 118 healthcare organizations that were victims in Q3 2025.

4.89% of global ransomware victims (organizations and individuals) in Q3 2025 were from Germany.

IncRansom had 62 victim claims (organizations and individuals) in Q2 2025.

GLOBAL and BlackLock had four distinct names in a little over a year.

Qilin claimed 10 healthcare organizations as victims in Q3 2025.

IncRansom claimed 14 healthcare organizations as victims in Q3 2025.

The Qilin campaign claimed 29 financial organizations headquartered in the Republic of Korea as victims to their DLS in a mid-September Qilin campaign.

2.35% of global ransomware victims (organizations and individuals) in Q3 2025 were from France.

2.48% of global ransomware victims (organizations and individuals) in Q3 2025 were from the Republic of Korea.