Ransomware attacks climbed 58 percent year over year in 2025, ending the year with 7,515 claimed victims and a weekly average of 145 new names added to dark web leak sites. The fourth quarter alone produced 2,287 unique victims, the largest quarterly total tracked to date, and December's 814 attacks marked a 42 percent jump from the same month in 2024.
Behind those numbers sits a crowded and increasingly organized criminal market. Researchers counted 124 distinct named ransomware groups active in 2025, a 46 percent increase from the year before and the highest count ever recorded. One group, Qilin, claimed 1,044 victims in 2025, up from 154 the prior year, a rise steep enough that it out-attacked LockBit at that group's peak. The United States absorbed 55 percent of tracked attacks, with Canada a distant second at 4.5 percent.
Sector data complicates the instinct to assume healthcare and finance sit at the top of every ransomware list. Manufacturing was the most targeted industry at 14 percent of attacks, followed by technology at 9 percent and retail and wholesale at 7 percent. Healthcare ranked fourth, with more than 500 organizations hit, a real number but not the outsized share the sector's regulatory profile might suggest.
What keeps healthcare vulnerable looks less like external siege and more like internal habit. Insiders are now responsible for 70 percent of healthcare data breaches, up from 39 percent four years earlier, and roughly two in three healthcare employees are taking security shortcuts that put patient data at risk. From 2021 through 2024, healthcare organizations reported more than 700 large breaches a year, exposing the protected health information of more than 595 million people across the four-year stretch, an average of nearly 204,000 individuals per incident.
Those breaches trace back to a narrow set of recurring habits. Employees click phishing links, download malware onto hospital systems, feed patient data into consumer AI tools, and misconfigure databases that then sit exposed to anyone who finds them. Separate misconfiguration cases have ranged from roughly 86,000 records to as many as 12 million.
Read together, the two data sets point at the same problem from different directions. Attackers are multiplying and organizing faster than defenses are hardening, and the softest points in a given network are increasingly the people using it rather than the software meant to protect it. Researchers behind the year-end ransomware count expect that gap to widen rather than close: "The year 2026 will likely see continued convergence of criminal innovation and AI capabilities, demanding that defenders adopt equally sophisticated technologies and intelligence-led approaches."
Leave a Reply