Remote access tools like VPNs and RDP were correlated with 80% of ransomware attacks in 2024, up from 63% the year prior.

Ransomware payments dropped by 35% worldwide in 2024

The industries most heavily impacted by ransomware in Q1 2025 were manufacturing, retail, and technology. Notably, the non-profit sector saw a dramatic surge in ransomware attacks, with incidents doubling quarter-over-quarter .

The average cost of third-party ransomware incidents jumped by 72% to $241K.

Ransomware gangs claimed responsibility for targeting 6,133 victims in 2024.

Close to 50 ransomware groups were implicated in attacks in 2024, a 3X increase from 2021.

96% of organizations attacked by ransomware said backups were targeted.

54% of IT professionals view target backup appliances as more secure than integrated appliances.

Over 90% of IT decision-makers said that Zero Trust principles, storing backup copies in multiple locations, and segmenting backup software and storage provide the defense needed to protect against ransomware threats.

49% of affected organizations took up to five business days to recover from a ransomware attack.

45% of organizations experienced multiple ransomware attacks.

Most affected organizations could not recover all of their data after a ransomware attack.

94% of IT decision-makers said that immutable backups are essential to achieving a comprehensive ransomware protection strategy.

Two-thirds of organizations suffered a ransomware attack.

Almost every organization (96%) that has experienced a ransomware attack in the past two years said that their backup data has been targeted at least once.

81% of IT professionals say immutable backup storage built on Zero Trust principles is the best defense against ransomware.

23% of UK businesses have been affected by ransomware .

1% of IoMT devices carry KEVs linked to active ransomware campaigns and insecure internet connectivity, impacting 89% of organisations.

89% of healthcare organisations have the top 1% of riskiest IoMT devices on their networks, which contain known exploitable vulnerabilities (KEVs) linked to active ransomware campaigns and an insecure connection to the internet.

41.4% of ransomware attacks now start through third parties