Europe experienced an 8% drop in June 2025, accounting for 21% of ransomware attacks (79 cases). This was fewer than half the number recorded in North America.

SafePay dropped to fourth place of most active threat groups in June 2025 with 27 attacks.

Asia had a 12% share of ransomware attacks (43 cases) in June 2025.

Qilin ranked as the third most active threat group in May 2025 with 42 attacks.

North America remained the hardest-hit region, accounting for 58% of all global ransomware attacks (215 cases) in June 2025.

Qilin saw a significant rise in Q2 2025 with 151 attacks, up from 95 attacks in Q1.

Akira was the second most active threat group in June 2025, with 31 attacks, rising from fourth place in May.

Healthcare ranked third in June 2025 with 42 ransomware attacks, nearly doubling from 22 in May.

The Handala ransomware group, a pro-Palestine group, targeted 17 Israeli organisations between 14th and 30th June 2025. These attacks coincided with the 12-day Iran-Israel war.

Ransomware attacks in the Consumer Discretionary sector (including retail) fell significantly from 102 in May 2025 to 76 in June 2025.

North America was responsible for 52% of ransomware attacks across Q2 2025.

Qilin was the most active threat group in June 2025, responsible for 16% of all attacks, which amounted to 60 cases.

Play dropped to third place of most active threat groups in June 2025 with 29 attacks.

There was a 63% increase in publicly disclosed ransomware attack volumes in Q2 2025 compared to Q2 2024.

May had a 40% increase in publicly disclosed ransomware attacks year-on-year, with a total of 91 attacks.

April experienced a 51% increase in publicly disclosed ransomware attacks year-on-year, with a total of 89 attacks.

95% of publicly disclosed ransomware attacks involved the theft of sensitive information.

The Construction, Hospitality, and Arts and Entertainment sectors reported their highest ever Q2 2025 ransomware attack volumes.

A total of 276 publicly disclosed ransomware incidents occurred from April to June 2025.

June 2025 saw a 113% increase in publicly disclosed ransomware attacks year-on-year, with a total of 96 attacks.