Organizations in the education sector reported an average dwell time of about 5 weeks prior to a ransomware incident.

The finance sector had an average ransom payment of $3.8 million

The percentage of organizations experiencing 20 or more ransomware incidents annually increased from 0% to 3% year-over-year.

70% of organizations reported that they paid the ransom in 2023

20% of organizations in the healthcare sector experienced ransomware incidents annually.

Scattered Spider was detected in 22.0% of cybersecurity incidents over the last 12 months.

Organizations experienced an average of 5 to 6 ransomware incidents over the last 12 months, marking a 25% decrease from nearly 8 incidents in 2024.

CDK Global reported a ransom payment of $50 million

10% of organizations in the government sector experienced ransomware incidents annually.

Organizations in the government sector reported an average dwell time of about 7 weeks prior to a ransomware incident.

GLOBAL and BlackLock had four distinct names in a little over a year.

There were 1,576 total public posts related to ransomware victims (organizations and individuals) in Q3 2025.

SafePay impacted 71 organizations and individuals across 19 industries and 16 countries in Q3 2025.

In Q3 2025, manufacturing organizations experienced a 26% increase in ransomware attacks.

Qilin recorded 234 victims (organizations and individuals) in Q3 2025.

56.00% of global ransomware victims (organizations and individuals) in Q3 2025 were from the United States.

Akira had 133 victims (organizations and individuals) in Q2 2025.

The emerging threat group 'The Gentlemen' posted 32 victims (organizations and individuals) on a single day once their data leak site went live in 2025.

2.35% of global ransomware victims (organizations and individuals) in Q3 2025 were from France.

Qilin claimed 10 healthcare organizations as victims in Q3 2025.