Ransomware attacks grew in frequency to 608 per month, or roughly 20 per day.

3,662 ransomware victims were tracked globally by KELA in the first half of 2025. This represents a 54% increase year-over-year (YoY) compared to the first half of 2024, as KELA tracked a total of 5,230 victims in all of 2024.

Clop ransomware experienced a 2,300% increase in victim claims, which was driven by the exploitation of a vulnerability in Cleo software.

SCATTERED SPIDER moved from initial access to encryption by deploying ransomware in under 24 hours in one observed case

Ransomware attacks are averaging 20 incidents per day.

There were 3,649 documented ransomware attacks in H1 2025.

In Singapore, the extortion threat in ransomware attacks surged to 66%, a jump of 40% and the highest among the surveyed countries.

11% of companies paid ransoms three times or more.

In Singapore, 50% of companies paid ransoms multiple times.

Nearly 20% of companies that paid a ransom either received corrupt decryption keys or the hackers still published stolen data

In 40% of ransomware attacks, threat actors threatened to physically harm executives at organizations that declined to pay a ransom demand.

US-based companies experienced physical threats in 46% of ransomware attacks.

The top cybersecurity challenge facing organizations is the sophistication of attacks (37%).

In the US, the rate of regulatory blackmail threats (hackers threatening to file regulatory complaints against victims if they didn't report the ransomware incident) jumped to 58%, representing a 23% increase.

38% of companies that paid ransoms did so multiple times.

Ransomware has risen by 179% since the start of 2025.

47% of attacked companies across various countries (US, UK, France, Germany, Spain, Italy, Singapore, Canada, Australia, New Zealand) reported that hackers threatened to file regulatory complaints against them if they didn't report the ransomware incident.

69% of companies victimized by ransomware paid a ransom.

44% of German firms experienced physical forms of intimidation in ransomware attacks.

In the US, 47% of companies paid ransoms multiple times.