49% of security leaders report experiencing moderate to significant disruption to business operations from ransomware.

89% of security leaders report some impact on business operations due to ransomware.

98% of organizations rely on Endpoint Detection and Response (EDR) for ransomware defense.

35% of security leaders call ransomware their organization's number-one business priority.

49% of ransomware victims admit they detected their last attack too late to prevent significant damage.

99% of security leaders express confidence in their ability to detect ransomware attacks.

A record 86% of businesses refused to pay ransom demands.

49 different ransomware groups publicly impacted organizations worldwide during February

Ransomware was the most costly type of cyber claim in 2025 with an average loss of $269,000.

The most targeted sectors by ransomware in LATAM in descending order were consumer and industrial products; energy, resources and agriculture; and professional services and consulting.

The median ransom payment grew 368% year-over-year to nearly $60,000.

Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%.

2025 ransomware market share by group: Qilin (23%), Akira (18%), Cl0p (14%), Play (10%), INC (9%), Safepay (8%), Lynx (7%), RansomHub (6%), DragonForce (5%).

Data leak site-claimed ransomware incidents grew by 50% YoY — an all-time high.

Brazil accounted for about 30% of ransomware victims in LATAM in 2025, followed by Mexico at about 14% and Argentina at about 13%.

Qilin claimed the most victims in 2025 (835), followed by Akira (650), Cl0p (517), Play (363), INC (334), Safepay (306), Lynx (253), RansomHub (233), DragonForce (181), and Babuk (176).

On-chain analysis indicates that spikes in IAB inflows typically precede increases in ransomware payments and victim leaks by roughly 30 days.

The most impacted industries by ransomware in LATAM were retail, wholesale and distribution; agriculture and food and beverage production; and health care providers and services.

26% of SMBs experienced ransomware attacks in the past 12 months.

The number of ransomware variants in LATAM rose from 48 to 79 with the most impactful gangs being the Qilin, The Gentlemen, SafePay, Akira and Inc. groups.