February Sees Record-Breaking Ransomware Attacks, New Data Shows

## Executive Summary February 2025 experienced a record spike in ransomware activity with 821 organizations claimed on ransomware data-leak sites, driven largely by CL0P’s exploitation of Cleo MFT vulnerabilities (including a published fourth batch of 218 alleged victims); the report analyzes long-term trends, top ransomware groups, geographic and industry impacts, and urges organizations to strengthen defenses such as patching, zero trust, segmentation, and ransomware-resistant backups.