Ransomware Attacks Surge by 49% in 2025, AI Threats Emerge

Cybersecurity experts report a worrying trend, with a staggering **49%** year-over-year increase in publicly disclosed ransomware attacks. In **2025**, a record **1,174** incidents were documented globally, highlighting the intensifying threat landscape. The findings are part of BlackFog’s recent **2025 State of Ransomware Report**, which outlines both disclosed and undisclosed ransomware activities observed throughout the year.

The report reveals a concerning reality where **86%** of ransomware attacks go unreported, indicating a significant rise in undisclosed incidents. There has been a **37%** increase in these unreported attacks from **2024** to **2025**. Healthcare organizations continue to face persistent targeting, with the United States remaining the primary focus for such cyber threats.

The Rise of Ransomware Groups and AI Threats

The report identifies **130** different ransomware groups that executed attacks in **2025**, including **52** newly emerged groups, reflecting a **9%** increase compared to the previous year. The Qilin group stood out as the most active, claiming an alarming **1,115** victims across both disclosed and undisclosed attacks. Akira and INC followed closely, ranking second and third respectively in terms of disclosed and undisclosed activity.

In a notable development, **2025** marked the emergence of AI-enabled ransomware attacks. Threat actors leveraged Anthropic’s **Claude** model to autonomously conduct reconnaissance, exploitation, and data theft—representing a groundbreaking shift in the tactics employed by cybercriminals.

Sector Vulnerabilities and Global Impact

The retail sector became a prominent target in **2025**, with high-profile attacks affecting brands such as M&S, Cartier, and Chanel. Despite this, the healthcare sector remained the most targeted, accounting for **22%** of all disclosed ransomware attacks. While the services industry saw a dramatic **118%** increase in attack volumes, the education sector experienced a **12%** decrease in incidents.

The report underscores that no nation is immune, as organizations across **135 countries** (approximately **69%**) reported being affected by ransomware attacks. Among disclosed incidents, the United States was the hardest hit, accounting for **58%** of all recorded attacks. Australia and the United Kingdom followed, with **110** and **42** incidents respectively.

When examining undisclosed attacks, the United States again topped the list, suffering **3,768** incidents. Canada and Germany were also significantly impacted, accounting for **6%** and **4%** of undisclosed attacks. Notably, the Qilin ransomware group executed a concentrated campaign targeting South Korean organizations, marking one of the most intense national attacks of the year.

The surge in undisclosed ransomware activity is alarming. In **2025**, ransomware groups announced **7,079** victims on dark web leak sites, which represents a **37%** increase compared to **2024**. This data signifies that approximately **86%** of ransomware attacks are never publicly reported, raising critical questions about the true scale of the threat.

As ransomware attacks continue to evolve and grow in frequency, the findings from BlackFog’s report serve as a crucial reminder for organizations worldwide to enhance their cybersecurity measures and remain vigilant against emerging threats.