96% of organizations attacked by ransomware said backups were targeted.

Over 90% of IT decision-makers said that Zero Trust principles, storing backup copies in multiple locations, and segmenting backup software and storage provide the defense needed to protect against ransomware threats.

49% of affected organizations took up to five business days to recover from a ransomware attack.

Most affected organizations could not recover all of their data after a ransomware attack.

23% of UK businesses have been affected by ransomware .

20% of HIS (hospital information systems), which manage clinical patient data, as well as administrative and financial information, have KEVs linked to ransomware and insecure internet connectivity, impacting 58% of organisations

41.4% of ransomware attacks now start through third parties

1% of IoMT devices carry KEVs linked to active ransomware campaigns and insecure internet connectivity, impacting 89% of organisations.

89% of healthcare organisations have the top 1% of riskiest IoMT devices on their networks, which contain known exploitable vulnerabilities (KEVs) linked to active ransomware campaigns and an insecure connection to the internet.

Ransomware attacks surged by 132% in Q1 2025.

14% of SMBs experienced ransomware attacks in the past 12 months.

A ransomware attack on a dealership software provider in June 2024 disrupted operations at more than 15,000 North American dealerships

Ransomware payloads in phishing attacks have risen by 22.6% over six months, with a sharp 57.5% increase in just three months.

There was a 22.6% increase in ransomware payloads.

83% of all ransomware cases globally took place in North America and Europe in February 2025.

Cl0p was the most active threat group in February 2025, responsible for 37% of attacks.

February ransomware attacks (886) increased by 50% from January 2025 (590).

Akira was the third most active ransomware group, with 77 attacks in February 2025.

February attacks reached an all-time monthly high of 886.

Cl0p was responsible for 330 attacks in February 2025, a 460% increase from January (59).