Global ransomware attacks decreased by 6% month-on-month in June 2025, with 371 cases recorded.

Qilin saw a significant rise in Q2 2025 with 151 attacks, up from 95 attacks in Q1.

The Handala ransomware group, a pro-Palestine group, targeted 17 Israeli organisations between 14th and 30th June 2025. These attacks coincided with the 12-day Iran-Israel war.

Ransomware attacks in the Consumer Discretionary sector (including retail) fell significantly from 102 in May 2025 to 76 in June 2025.

Play dropped to third place of most active threat groups in June 2025 with 29 attacks.

Qilin was the most active threat group in June 2025, responsible for 16% of all attacks, which amounted to 60 cases.

96% of MSPs say cybersecurity offerings improve client retention.

Most MSPs use four security tools from four different vendors.

Overall, 79% of all global ransomware cases in June 2025 took place in North America and Europe combined

North America was responsible for 52% of ransomware attacks across Q2 2025.

Qilin ranked as the third most active threat group in May 2025 with 42 attacks.

60% of enterprise firewalls fail high-severity compliance checks immediately upon evaluation.

Asia had a 12% share of ransomware attacks (43 cases) in June 2025.

Industrials represented nearly a third (30%) of all ransomware attacks in Q2.

Industrials remained the most targeted sector, accounting for 27% of all attacks in June 2025, which was 102 cases.

North America remained the hardest-hit region, accounting for 58% of all global ransomware attacks (215 cases) in June 2025.

MSPs manage an average of 1,728 endpoints.

The Information Technology sector came fourth in June with 33 ransomware attacks.

30% of firewall rules are completely unused.

MSPs respond to over 100 security incidents per year.