Ransomware attacks increased by 63% year-over-year in the second quarter of 2025, with a total of 276 publicly disclosed incidents, according to a new report from BlackFog.
Notably, there were far more ransomware attacks that weren’t publicly disclosed. The researchers note, “The figures also reveal that the scale of hidden activity remains significant, with 80.9% of all ransomware attacks going unreported. Across Q2 there were 1,446 undisclosed ransomware attacks marking a 19% increase compared to the same quarter in 2024.”
Of the publicly known ransomware attacks, the healthcare sector was the hardest hit, with 52 attacks last quarter. Additionally, attacks against the retail industry surged compared to the first quarter of 2025.
“The retail sector recorded its highest ever Q2 attack volumes, with UK retailers in particular bearing the brunt of high-profile ransomware attacks,” BlackFog writes.
“The number of publicly disclosed ransomware incidents in this sector jumped by 58% compared to Q1 2025. The Construction, Hospitality, and Arts and Entertainment sectors also reported the highest ever Q2 attack volumes. Across the board, the use of data exfiltration remained consistently high, with 95% of publicly disclosed attacks involving the theft of sensitive information.”
The researchers observed dozens of ransomware groups in Q2 2025, with the Qilin gang accounting for the most attacks.
“Amongst 53 active ransomware groups, the Qilin ransomware gang took the lead as the most active, responsible for 10% (28) of disclosed attacks and 15% of those revealed on dark web leak sites,” BlackFog says. “Earlier this year, CISA issued a formal warning after Qilin struck high profile targets in the UK and US with the group labelled a major risk to critical infrastructure.”
New-school security awareness training can give your organization an essential layer of defense against cyberattacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
BlackFog has the story.
Here's how it works:
