Ransomware Attack 2025 Recap – From Critical Data Extortion to Operational Disruption

**Executive summary:** The 2025 ransomware landscape saw record attack volumes (4,701 confirmed incidents Jan–Sep; 6,330 leak-site cases by October) while ransom payment rates collapsed to ~23–25%, driving fragmentation into ~85 active extortion groups (notably Qilin, Cl0p, LockBit, Play, Scattered Spider) that leveraged zero-days, supply-chain exploits (MOVEit, GoAnywhere, Cleo), AI-enhanced phishing, and cross-platform payloads to target critical infrastructure, healthcare, cloud/ESXi environments and inflict systemic operational and societal impacts including large-scale data theft, service disruption, and at least one confirmed death linked to an attack.