Asia had a 12% share of ransomware attacks (43 cases) in June 2025.

Europe experienced an 8% drop in June 2025, accounting for 21% of ransomware attacks (79 cases). This was fewer than half the number recorded in North America.

Healthcare ranked third in June 2025 with 42 ransomware attacks, nearly doubling from 22 in May.

Akira was the second most active threat group in June 2025, with 31 attacks, rising from fourth place in May.

South America had a 4% share of ransomware attacks (15 cases) in June 2025.

SafePay dropped to fourth place of most active threat groups in June 2025 with 27 attacks.

Play dropped to third place of most active threat groups in June 2025 with 29 attacks.

Qilin saw a significant rise in Q2 2025 with 151 attacks, up from 95 attacks in Q1.

Industrials represented nearly a third (30%) of all ransomware attacks in Q2.

North America remained the hardest-hit region, accounting for 58% of all global ransomware attacks (215 cases) in June 2025.

Ransomware attacks in the Consumer Discretionary sector (including retail) fell significantly from 102 in May 2025 to 76 in June 2025.

The Information Technology sector came fourth in June with 33 ransomware attacks.

Qilin was the most active threat group in June 2025, responsible for 16% of all attacks, which amounted to 60 cases.

North America was responsible for 52% of ransomware attacks across Q2 2025.

Industrials remained the most targeted sector, accounting for 27% of all attacks in June 2025, which was 102 cases.

Overall, 79% of all global ransomware cases in June 2025 took place in North America and Europe combined

The services industry was the hardest hit among undisclosed attacks, accounting for 23% (337) of all undisclosed attacks in Q2 2025.

The Construction, Hospitality, and Arts and Entertainment sectors reported their highest ever Q2 2025 ransomware attack volumes.

April experienced a 51% increase in publicly disclosed ransomware attacks year-on-year, with a total of 89 attacks.

There were 1,446 undisclosed ransomware attacks in Q2. This marks a 19% increase in undisclosed attacks compared to the same quarter in 2024.