Ransomware attacks kept climbing in 2025 as gangs refused to stay dead

If 2025 was meant to be the year ransomware started dying, nobody appears to have told the attackers.

In its 2025 State of Ransomware in the US report, security firm Emsisoft says ransomware attacks continued to climb last year, with more victims appearing on extortion sites and more groups operating than ever before. The figures climbed even as police and prosecutors notched up a string of wins against ransomware groups, such as the global takedown of BlackSuit in August.

Trackers keeping an eye on ransomware leak sites logged more than 8,000 claimed victims worldwide in 2025, a rise of more than 50 percent compared to 2023. The counts come from outfits watching dark web shaming pages such as Ransomware.live and RansomLook.io, so they only include cases where crooks decided to post receipts. Plenty of victims, Emsisoft says, will have paid up, recovered, or kept quiet without ever ...