80.9% of all ransomware attacks go unreported.

The retail sector saw its highest ever Q2 2025 ransomware attack volumes, with publicly disclosed incidents jumping by 58% compared to Q1 2025.

The government sector was the second most targeted for ransomware, with 45 publicly disclosed attacks between April - June 2025.

There was a 63% increase in publicly disclosed ransomware attack volumes in Q2 2025 compared to Q2 2024.

95% of publicly disclosed ransomware attacks involved the theft of sensitive information.

May had a 40% increase in publicly disclosed ransomware attacks year-on-year, with a total of 91 attacks.

The healthcare sector was the most targeted with 52 publicly disclosed ransomware attacks between April - June 2025.

The services industry was the third most targeted for ransomware, with 33 publicly disclosed attacks between April - June 2025.

A total of 276 publicly disclosed ransomware incidents occurred from April to June 2025.

June 2025 saw a 113% increase in publicly disclosed ransomware attacks year-on-year, with a total of 96 attacks.

There were 191 disclosed ransomware victims in the financial sector in 2023.

52% of observed ransomware victims in Q2 2025 were based in The United States.

23% of observed ransomware victims in Q2 2025 were based in Singapore.

Qilin saw an 85% increase in activity, making it the most active threat group in Q2 2025.

As of mid-2025, only 55 ransomware victims have been disclosed in the financial sector.

There was a 23% decline in publicly reported ransomware incidents in Q2 2025, which may indicate changing attacker patterns beyond seasonal norms.

There has been a 45% year-over-year rise in active ransomware groups.

Nearly one-third (26.6%) of finance threat actors are attributed to "Other", which includes emerging or short-lived groups, highlighting a more fragmented and unpredictable ransomware landscape.

5% of observed ransomware victims in Q2 2025 were based in Canada.

There were 156 disclosed ransomware victims in the financial sector in 2024.