Ransomware crews are working through the telecom sector at a pace the industry has not seen before. Threat intelligence firm Cyble counts 90 ransomware attacks on telecom companies in 2025, up from 24 in 2022, alongside 444 incidents involving data theft from telecom firms and 133 listings of stolen databases. The sector's exposure comes from "its role as critical national infrastructure and its access to high-volume subscriber data," the report says, with roughly 70 percent of 2025 attacks landing in the Americas and Qilin the most active group, ahead of Akira, Play and DragonForce.
Cyble attributes the pattern to "frequent exposure through internet-facing infrastructure and third-party service dependencies," and notes that attacks "were frequently enabled by the rapid weaponization of critical and zero-day vulnerabilities." Orange, the telecom operator hit with a network disruption in July 2025, appears among the named victims, and the report also points to the Salt Typhoon intrusions at US carriers.
Telecom is not an outlier so much as a leading indicator. Emsisoft's State of Ransomware in the US report tallies more than 8,000 organizations claimed as targets by cybercrime groups in 2025, up from roughly 6,000 the year before, while the number of active ransomware groups grew about 30 percent against 2024.
Healthcare shows what those numbers mean on the ground. Covenant Health, a Massachusetts-based system with locations across six states, now says a May 2025 intrusion compromised data on 478,188 people, a figure it first reported as 7,800 before correcting the count in a December 31 filing with Maine's attorney general. Qilin claimed that attack too, saying it stole more than 1.3 million files, and later published the data, an indication no ransom was paid. Stolen records included Social Security numbers, medical record numbers and treatment information.
Not every large exposure needs an attacker. The Illinois Department of Human Services says a mapping website left accessible to the public exposed information on about 700,000 people, including case numbers and demographic details for roughly 672,000 Medicaid and Medicare Savings Program recipients, over a window stretching back to 2021. Whether anyone accessed the data during that period remains unknown.
Regulators are turning to the next attack surface before it matures. NIST's Center for AI Standards and Innovation issued a Federal Register notice asking the public for concrete practices for securing AI agents, with 60 days to respond. "If left unchecked, these security risks may impact public safety, undermine consumer confidence, and curb adoption of the latest AI innovations," the agency says, and the concern is sharpest where agents touch critical infrastructure networks, the same territory the telecom numbers describe.
Enforcement, meanwhile, has become a matter of statecraft. France recovered researcher Laurent Vinatier from a Russian prison in an exchange for Daniil Kasatkin, a Russian basketball player arrested at a Paris airport and wanted in the United States for alleged involvement in ransomware attacks. When accused ransomware operators become trading pieces between governments, the odds of conventional prosecution get longer, and the economics that produced a fourfold rise in telecom attacks stay intact.
Leave a Reply