53% of US IT and security professionals at companies with at least 1,000 employees are very confident they can quickly recover from an AI-driven ransomware attack.

62% of US IT and security professionals at companies with at least 1,000 employees believe AI makes it more likely their company will need to pay a ransom to regain access to its data after an attack.

Total ransomware leak posts increased 46.4% year over year, rising to 8,835 in 2025.

Ransomware was involved in 42% of Rapid7 MDR incident response investigations last year.

52% of organizations say their average ransomware payout exceeds their annual cybersecurity budget.

Prior compromise was the top initial infection vector in ransomware operations at 30%, up from 15% in 2024.

The average initial ransomware demand increased 70% to $4.2 million compared to the previous year.

Qilin was the most seen ransomware variant in 2025.

Global ransomware payments reached $820 million in 2025.

129 ransomware groups were active during 2025.

55% of security, IT, and compliance professionals say AI-related data exposure or misuse is their top breach concern, exceeding concerns about ransomware, IAM failures, or cloud misconfigurations.

61% of U.S. respondents say their organization’s average ransomware payout exceeds its annual cybersecurity budget. 83%

According to their data leak site, in 2025, Qilin targeted more than 40 victims every month except January.

In 2025, 88% of SMB breaches involved ransomware, more than double the rate at large enterprises.

More than 7,000 ransomware incidents were reported globally in 2025.

The average ransomware payment increased 36% to $682,702 compared to the previous year.

Qilin affiliates take home a significant portion of their ransom payments (up to 80 - 85%), higher than typical RaaS payout structures.

Global traceable ransomware payments fell from $892 million in 2024 to $820 million in 2025.

89% of security leaders report some impact on business operations due to ransomware.

The United States was the most impacted country, accounting for 51% of all reported ransomware attacks.