In the 12 months from March 2025, industrial organisations accounted for 29.6% of all ransomware activity on average.

20% of CISOs report taking as long as two weeks to recover from a ransomware attack.

Across 2025, 7,918 victim postings were observed on ransomware group data-leak sites (DLS) across 129 distinct threat actors sourced from ransomware.

When identity breaches impact business, the primary consequences are data theft (49%), ransomware (48%), and financial theft (47%).

48% of all breaches now involve ransomware.

58% of enterprise CISOs agree that a ransomware incident left endpoints inoperable.

Ransomware victims were located in 97 countries in Q1 2026.

Among undisclosed ransomware attacks in Q1 2026, Qilin led with 339 attacks (16%), The Gentlemen 200 attacks (9%), and Akira 190 attacks (9%).

57% of CISOs report taking as long as six days to recover from a ransomware attack.

69% of ransomware victims didn’t pay.

Compromised credentials accounted for 74% of ransomware intrusions observed by Beazley Security investigators in Q1 2026.

83% of CISOs report being confident in their businesses' ability to recover from ransomware.

SCATTERED SPIDER resumed aggressive ransomware operations against insurance entities in the first half of 2025 after a four-month pause.

Organizations across 39 countries were impacted by disclosed ransomware attacks in Q1 2026.

42% of CISOs report legacy system patching is the second most challenging ransomware mitigation method.

The average volume of data stolen per undisclosed ransomware incident was 743 GB in Q1 2026.

Over 100 advertised leaks and ransomware breaches targeted the automotive supply chain on the dark web in Q4 2025

67% of ransomware victims confirmed their ransomware incident stemmed from an identity attack.

Among publicly disclosed attacks, Qilin was responsible for 22 attacks (8%), ShinyHunters 16 attacks (6%), and INC 11 attacks (4%).

Ransomware payouts now average $40 million, nearly triple their level in 2024.