- Ransomware victims increased from ~5,400 in 2023 to 8,000+ in 2025, an increase of 53-63%
- Large groups such as RansomHub, BianLian and Hunters International shut down, but the total number grew
- Active groups rose to 126-141, with Qilin, Cl0p, Play and INC Ransom leading the charge
Despite the best efforts of the police to rid the world of ransom, not much has changed in 2025 and the infamous cybercriminal practice continued its upward trajectory.
This is according to “The State of Ransomware in the US: Report and Statistics 2025”, a new report released by security researchers Emsisoft.
Based on data from two separate sources — RansomLook.io and Ransomware.live — collected between 2023 and 2025, Emsisoft determined that some of the biggest players were either disrupted by law enforcement or shut down on their own. But that did little to slow the attacks.
The disappearance of giants
“Since 2023, the number of globally claimed victims has increased from approximately 5,400 annually to over 8,000 in 2025,” the report said.
“Double-digit annual growth has led to increases in 2023/2025 of between 53% (using Ransomware.live data) and 63% (RansomLook.io data).” Emsisoft also added that the actual numbers are likely to be significantly higher, as only a minority of incidents are reported and tracked.
At the same time, some of the groups seen as the biggest threats were shut down or disappeared last year. It includes RansomHub (broken Kawasaki Motors Europe, Planned Parenthood and Manpower), BianLian (Boston’s Children’s Health Physicians, Mizuno USA, Northern Minerals) or Hunters International (Tata Technologies, Dell), as well as many others: Babuk-Bjorka, FunkSec, 8Base and Cactus.
In absolute terms, the number of ransomware groups actually grew. In fact – the more victims there are, the more attackers there are. The data shows around 70 active groups in 2023, rising to between 126 and 141 in 2025.
Qilin, Akira, Cl0p, Play, Safepay and INC Ransom seem to be the most active groups this year, pushing out older heavy hitters like LockBit, ALPHV (now shut down), 8Base or Akira.
“The disappearance of successful groups often results in open competition to attract the most productive affiliates,” concludes Emsisoft. We can hope that although the number of victims continues to rise, the pressure from international law enforcement activity appears to be having an impact on the criminal gangs.”
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
