In September 2025, Qilin's compromise of a single South Korean MSP affected 32 financial institutions and resulted in over 2 terabytes of stolen data.

Reported ransomware incidents targeting finance increased 30% from 2024 to 2025.

Direct ransomware attacks on financial institutions spiked 76% year-over-year in Q1 2026.

Qilin was responsible for 59 finance-sector incidents in the past year.

23% of Nordic CISOs cited ransomware or availability disruption as their primary concern.

Only one in nine global ransomware attacks were publicly disclosed in Q1 2026.

Government entities experienced 32 publicly disclosed ransomware attacks (12%) and the technology sector experienced 28 attacks (11%) in Q1 2026.

58% of cybersecurity leaders would consider paying cybercriminals to end a ransomware attack.

There were 264 publicly disclosed ransomware attacks in Q1 2026, a 15% decrease year-on-year.

67% of ransomware victims confirmed their ransomware incident stemmed from an identity attack.

20% of CISOs report taking as long as two weeks to recover from a ransomware attack.

Data exfiltration occured in 96% of ransomware attacks in Q1 2026.

The average volume of data stolen per undisclosed ransomware incident was 743 GB in Q1 2026.

Ransomware payouts now average $40 million, nearly triple their level in 2024.

Organizations across 39 countries were impacted by disclosed ransomware attacks in Q1 2026.

57% of CISOs report taking as long as six days to recover from a ransomware attack.

38% of publicly disclosed ransomware incidents were not attributed to any known group in Q1 2026.

46% of cybersecurity leaders rank operational downtime as the most significant impact ransomware is likely to have on their organizations.

Over 100 advertised leaks and ransomware breaches targeted the automotive supply chain on the dark web in Q4 2025

Among publicly disclosed attacks, Qilin was responsible for 22 attacks (8%), ShinyHunters 16 attacks (6%), and INC 11 attacks (4%).