In 2025, ransomware attacks surged with AI tools and rising payments

By March 2025, Qilin had become the most active ransomware brand targeting industrial organizations. In 2025, the extortion model shifted from encryption to pure data‑theft, as Dragos and other threat‑intelligence reports noted.

In August 2026, more than 1,000 ransomware attacks occurred worldwide, marking a 12% increase from July and setting a new monthly high. North America accounted for 44% of those August attacks, the largest regional share. The industrial sector received 31% of August attacks, the highest proportion of any industry. Qilin was responsible for about 15% of the August 2026 attacks, making it the most active threat group that month.

Utility companies saw their ransomware attacks double from five in July to ten in August. Turning to 2025, the FBI’s Internet Crime Complaint Center logged 3,611 ransomware complaints, up from 3,156 in 2024. Ransomware appeared in 48% of all confirmed data breaches that year, up from 44% the previous year, according to the Verizon 2026 DBIR.

The number of victims extorted by ransomware rose 53% year‑over‑year and the count of active ransomware‑as‑a‑service groups (ransomware‑as‑a‑service, or RaaS, groups that lease ransomware tools) grew by 50%, per Check Point’s 2026 report. The FBI’s IC3 identified 63 new ransomware variants in 2025, averaging about 5.25 new strains each month. Chainalysis tracked nearly 8,000 ransomware leak events in 2025, a 50% jump from 2024.

In the first quarter of 2025, the median paid ransom was approximately $200,000, according to Coveware’s Marketplace Report. Only about 28% of ransomware victims paid a ransom in 2025, the lowest rate ever recorded by Chainalysis. Chainalysis also reported that the median ransomware payment rose to roughly $59,500–$60,000, a 368% increase from approximately $12,700 in 2024. Sophos’s 2025 survey found the mean ransom payment was $1 million, with 53% of paying organizations negotiating downward and 71% employing third‑party negotiators.

The Verizon 2026 DBIR reported a median ransom payment of $139,875 for 2025, down from $150,000 the previous year. IBM’s Cost of a Data Breach 2025 study placed the average total cost of a ransomware incident at $5.08 million. For healthcare specifically, the average breach cost was $7.42 million per incident in 2025, according to IBM. Sophos’s 2025 data showed the mean recovery cost (excluding the ransom) was $1.53 million, a 44% decline from $2.73 million in 2024.

The FBI’s 2025 IC3 report logged 460 ransomware attacks against healthcare and public health, the highest number for any critical infrastructure sector. In late August 2025, Jaguar Land Rover suffered a ransomware attack that halted production across several countries and caused an estimated $2.5 billion in total damage, described as the costliest cyber incident in UK history. According to Sophos’s annual survey, 32% of ransomware intrusions began with exploitation of unpatched vulnerabilities, 23% with compromised credentials and 18% with phishing in 2025.

The Verizon 2026 DBIR found that only 26% of CISA Known Exploited Vulnerabilities (CISA Known Exploited Vulnerabilities, a list of vulnerabilities known to be exploited in the wild) were fully remediated across more than 13,000 organizations studied in 2025, compared with a 54% remediation rate in the prior year. In 2025, 73% of ransomware victims had experienced an infostealer (infostealer, malware that steals credentials and data) infection or credential leak in the year before the attack, as revealed by the Verizon 2026 DBIR.

Chainalysis estimated that initial access brokers (initial access brokers, actors who sell access to compromised networks) earned at least $14 million in tracked cryptocurrency during 2025, representing roughly 1.7% of total ransomware payments. Group‑IB’s High‑Tech Crime Trends Report 2026 highlighted supply‑chain attacks as an emerging top global cyber threat, noting that industrialization of cybercrime has shifted the primary attack surface to identity and trust.

The FBI’s 2025 IC3 report was the first to document AI‑enabled ransomware complaints, recording over 22,000 such cases with adjusted losses exceeding $893 million. An MIT study of 2,800 2025 ransomware incidents found that 80% leveraged AI tools, and 82.6% of phishing emails contained AI‑generated content, per KnowBe4 data.

By March 2025, Qilin had become the most active ransomware brand targeting industrial organizations, a position it maintained thereafter. In June 2025, Qilin carried out 81 attacks, a 47.3% month‑over‑month increase that highlighted its rapid growth.

• March 2025: Qilin became the most active ransomware brand targeting industrial organizations.
• June 2025: Qilin carried out 81 attacks, a 47.3% month-over-month increase.
• Late August 2025: Jaguar Land Rover suffered a ransomware attack causing $2.5 billion in damage.
• July 2026: Utility companies recorded five ransomware attacks.
• August 2026: More than 1,000 ransomware attacks recorded worldwide, a 12% increase from July.