- Ransomware victims increased from around 5,400 in 2023 to more than 8,000 in 2025, an increase of 53% to 63%
- Big groups like RansomHub, BianLian and Hunters International have closed their doors, but overall numbers have increased
- Active groups increased to 126-141, with Qilin, Cl0p, Play and INC Ransom leading the attacks
Despite law enforcement’s best efforts to rid the world of ransomware, little has changed in 2025, and the infamous cybercriminal practice has continued on its upward trajectory.
That’s according to “The State of Ransomware in the US: Report and Statistics 2025,” a new report released by security researchers Emsisoft.
Based on data from two separate sources – RansomLook.io and Ransomware.live – collected between 2023 and 2025, Emsisoft determined that some of the biggest players were either disrupted by law enforcement or shut down on their own. But that did little to slow the attacks.
The disappearance of the giants
“Since 2023, the number of reported victims worldwide has increased from around 5,400 per year to more than 8,000 in 2025,” the report said.
“Double-digit annual growth has led to increases for 2023/2025 of between 53% (using data from Ransomware.live) and 63% (using data from RansomLook.io). Emsisoft also added that the actual numbers are likely much higher, since only a minority of incidents are reported and tracked.
At the same time, some of the groups considered the biggest threats were shut down or disappeared last year. This includes RansomHub (violation of Kawasaki Motors Europe, Planned Parenthood and Manpower), BianLian (Boston’s Children’s Health Physicians, Mizuno USA, Northern Minerals) or Hunters International (Tata Technologies, Dell), as well as many others: Babuk-Bjorka, FunkSec, 8Base and Cactus.
However, in absolute terms, the number of ransomware groups has increased. In fact, the more victims there are, the more attackers there are. The data shows around 70 active groups in 2023, and between 126 and 141 in 2025.
Qilin, Akira, Cl0p, Play, Safepay and INC Ransom seem to be the most active groups this year, knocking out older heavyweights such as LockBit, ALPHV (now closed), 8Base or Akira.
“The disappearance of successful groups often results in open competition to attract the most productive subsidiaries,” concludes Emsisoft. We can hope that although the number of victims continues to rise, the pressure from international law enforcement appears to be having an impact on criminal gangs. »
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
