Executive Summary
As we close out 2025 and look toward 2026, the ransomware ecosystem has undergone a dramatic transformation that fundamentally changes how organizations must approach cyber defense. With attacks surging 34% year-over-year while ransom payments plummet to historic lows, threat actors are evolving their business models in ways that make traditional defensive strategies obsolete. November 2025 alone demonstrated the relentless pace of breaches across financial services, healthcare, retail, and critical infrastructure, signaling that the volume-versus-value equation in cybercrime has reached an inflection point.
Breached CompanyBreached Company
The New Attack Economics: More Breaches, Fewer Payments
The most striking development in 2025 is the paradox gripping the ransomware economy: attack volumes have reached unprecedented heights while the traditional encryption-based business model collapses under its own weight.
The Numbers Tell a Stark Story
Throughout 2025, ransomware incidents surged to record levels—a 34% increase over 2024. Yet despite this surge, ransom payments have fallen to their lowest levels on record. The data reveals a cybercriminal ecosystem in transition:
- 149% increase in reported U.S. ransomware incidents in the first five weeks of 2025 compared to 2024
- Average ransomware insurance claims rose 68% to $353,000, even as payment rates declined
- 76% of all ransomware attacks now involve data exfiltration prior to encryption
- 50% of attacks in 2025 targeted critical infrastructure sectors: manufacturing, healthcare, energy, transportation, and finance
This fundamental shift reveals that encryption is no longer the primary weapon—data theft has become the real leverage point. Organizations can no longer rely on ransomware encryption as the “signal” of a breach. Silent data exfiltration campaigns are now more common and more damaging, as evidenced by November’s breach landscape.
Manufacturing Under Siege
The manufacturing sector emerged as 2025’s most aggressively targeted industry, experiencing a 61% year-over-year increase in attacks. This concentration on manufacturing reflects attackers’ strategic pivot toward targets with the lowest tolerance for operational downtime.
High-profile incidents like Jaguar Land Rover’s global shutdown and Bridgestone’s production disruptions illustrated how ransomware can paralyze supply chains and entire economies. The manufacturing sector now accounts for 65% of industrial ransomware incidents in Q2 2025, with construction being the most impacted subsector.
The Codefinger Threat: Cloud Infrastructure as the New Battlefield
Perhaps no development better exemplifies the evolution of ransomware tactics than the emergence of the Codefinger threat actor, who pioneered a devastating new technique targeting AWS S3 buckets.
How Codefinger Rewrites the Playbook
Unlike traditional ransomware that deploys malicious software, Codefinger exploits AWS Server-Side Encryption (SSE-C) to lock victims out of their own cloud infrastructure without deploying any malware:
- Compromise AWS credentials through phishing, credential stuffing, or stolen API keys
- Encrypt all S3 objects using the victim’s encryption functionality
- Replace IAM policies to revoke the victim’s own access
- Set lifecycle deletion policies to auto-delete data in 7 days, creating artificial urgency
This technique is devastating because it triggers no malware alerts. It appears as legitimate administrative activity—a user encrypting data for security purposes. Standard data recovery tools become ineffective when the cloud infrastructure itself enforces the encryption.
Halcyon and Trend Micro researchers identified this as a “systemic threat” that forces organizations to rethink their Shared Responsibility Model, specifically regarding the lifecycle and permissions of API keys. The lesson: cloud security is no longer optional defense-in-depth—it’s the primary battlefield.
The Ransomware Group Ecosystem: Fragmentation and Consolidation
The collapse of dominant syndicates like LockBit and AlphV under law enforcement pressure didn’t slow the ransomware economy—it fractured and multiplied it.
The Power Vacuum Creates Opportunity
- 96 unique ransomware groups operated in the first half of 2025, a 41.18% increase over 2024
- 17 groups became inactive in Q2 2025 alone, including 8base, BianLian, BlackBasta, and Cactus
- 11 net new groups emerged in Q2 2025: KaWa4096, Warlock, Devman, Nova, and Dire Wolf
The New Power Players
Qilin became the most active ransomware group by June 2025, carrying out 81 attacks in a single month—a sharp 47.3% rise. Their sophisticated operations included:
- The Habib Bank AG Zurich breach, stealing 2.5TB of data and nearly 2 million files
- Multiple healthcare and financial services targets across jurisdictions
- Advanced double-extortion techniques combining data theft with encryption
DragonForce surged dramatically with attacks jumping 212.5%, forming shaky alliances with remnants of RansomHub to facilitate “bigger and better infrastructure.”
SafePay ransomware significantly accelerated operations, with industrial sector victims increasing from 13 in Q1 to 49 in Q2 2025. Unlike typical RaaS operations, SafePay maintains centralized control, directly managing all attack phases.
The INC Ransom Problem
One group deserves special attention for its complete abandonment of ethical boundaries: INC Ransom. Unlike traditional ransomware groups that claimed to avoid certain sectors, INC Ransom aggressively targets precisely those industries previously considered “off-limits”:
- Healthcare facilities (highest priority)
- Emergency notification systems
- Government law enforcement agencies
- Educational institutions
Their attack on Jackson County’s emergency warning systems left thousands of communities unable to send critical notifications for two weeks—one of the most serious attacks on public safety infrastructure in U.S. history.
Third-Wave Extortion: Beyond Encryption and Data Theft
The ransomware business model has evolved through distinct phases, and we’ve now entered what security researchers call the “Third Wave” of extortion: intentional business disruption.
The Triple-Extortion Model
Palo Alto Networks reports that in 86% of recent incidents, attackers deliberately tried to sabotage operations to force payment through tactics including:
- Wiping backups and cloud storage to eliminate recovery options
- Launching DDoS attacks to knock websites offline
- Publicly harassing customers, employees, and partners with threatening calls and emails
- Targeting business partners and suppliers to amplify pressure
- Reporting victims to regulators to trigger compliance penalties
This multi-pronged approach ensures victims face mounting costs from multiple directions simultaneously, even if they have robust backup systems. As one ransomware operator told researchers: “Backups are worthless if we destroy your reputation and regulatory standing first.”
The Insurance Industry’s Perfect Storm
The insurance sector’s 2025 nightmare demonstrates this evolution in action. Scattered Spider, operating alongside ShinyHunters, systematically worked through the sector with military-like precision:
- Farmers Insurance: 1.1 million customer records compromised via Salesforce breach
- Aflac: 50 million individuals affected, data including SSNs and health information
- Erie Insurance: Month-long network outage disrupting services for 6 million policyholders
- Philadelphia Insurance Companies: Personal data compromised, driver’s licenses exposed
Google’s Threat Intelligence Group warned that Scattered Spider “has a habit of working their way through a sector,” proving that entire industries can become systematically compromised when attackers identify profitable patterns.
Breached CompanyBreached Company
How They’re Getting In: The Two Dominant Vectors
The ransomware entry playbook has simplified to two primary attack vectors that account for the vast majority of successful compromises:
1. Exploited Vulnerabilities
For the fifth consecutive year, exploiting unpatched software remains the primary entry point. Attackers relentlessly scan for and target vulnerabilities on the network edge:
- VPN appliances (FortiGate, Cisco ASA, Pulse Secure)
- Firewalls (WatchGuard, Palo Alto, Fortinet)
- Remote access tools (Citrix, VMware, Microsoft RDP)
Recent critical alerts revealed the scale of exposure:
- Over 54,000 vulnerable WatchGuard Firebox devices exposed globally
- Approximately 48,000 unpatched Cisco ASA/FTD appliances remaining internet-facing
- Active exploitation confirmed within days of patch releases
2. Stolen Credentials
Credential theft is increasing rapidly and approaching parity with vulnerability exploitation as an initial access vector. Cybercriminals purchase employee credentials from dark web markets—often harvested by infostealer malware—and use them to “waltz right through the front door.”
Once inside, attackers increasingly “live off the land,” using legitimate IT tools like PowerShell, Windows Management Instrumentation (WMI), and Remote Desktop Protocol to move through networks undetected.
The Speed Problem
Modern ransomware operators work at breakneck pace. The median time from initial compromise to ransomware deployment has dropped to under 24 hours in many cases. Attackers know that modern security tools like Endpoint Detection and Response (EDR) will eventually spot them, so their goal is simple: get in, steal data, and deploy ransomware before the security team can react.
This high-velocity attack model puts immense pressure on detection and response capabilities, making real-time monitoring and automated response critical defensive requirements.
November 2025: A Month That Defined the New Normal
November 2025 provided a concentrated look at the evolving threat landscape, with major breaches spanning financial services, healthcare, retail, and critical infrastructure—demonstrating that no sector is immune.
Financial Sector Under Siege
Habib Bank AG Zurich became a prime target when the Qilin ransomware group claimed responsibility for stealing over 2.5 terabytes of data and nearly two million files, including customer details, transaction records, and internal source code. The Switzerland-based bank operates across multiple countries including the UK, UAE, Hong Kong, and Canada, amplifying the potential impact across jurisdictions.
Major Wall Street institutions also faced unauthorized data access during November, with attackers targeting high-value systems that process sensitive financial information. The pattern is clear: financial services remain a top-tier target due to the value of the data and the potential for direct monetization.
Retail & Consumer Platforms Hit Hard
Under Armour suffered a ransomware attack that targeted internal corporate systems, with threat actors claiming to have accessed millions of personal data records including internal documents, employee-related records, and operational files. The attack caused significant operational disruptions and increased compliance workloads across the company’s global operations.
DoorDash, the food delivery platform, also experienced a breach in November, reinforcing that social engineering of employees remains one of the most critical entry points for attackers.
Analytics & Cloud Providers Compromised
Mixpanel, an analytics platform used by thousands of companies, experienced a data breach that exposed internal records and operational details. When analytics providers are compromised, the ripple effect can impact every customer using their services.
Oracle faced unauthorized access to systems during November, affecting multiple enterprise customers who rely on Oracle’s cloud infrastructure and database services. Third-party and cloud provider breaches remain a persistent vulnerability in modern digital ecosystems.
Infrastructure & Government Targets
The London Councils cyber incident forced emergency service changes for over half a million residents, demonstrating how local authorities are vulnerable to systemic operational shutdowns. This attack highlighted the real-world consequences when critical infrastructure and government services are disrupted.
Jackson County experienced a cyber attack that caused data exposure and loss of emergency warning systems, showing that even smaller jurisdictions face sophisticated threats that can compromise public safety systems.
Corporate & Education Sector
The Washington Post suffered a cyber attack on an Oracle Platform that resulted in a massive data leak, affecting one of America’s major media organizations. Princeton University also experienced a data breach in November, continuing the trend of educational institutions being targeted for their research data and personal information stores.
Hyundai AutoEver secured affected systems after an incident that exposed employee data, triggering regulatory reporting requirements and increased scrutiny. The automotive technology sector is increasingly targeted as vehicles become more connected and data-rich.
Notable International Incidents
Askul, a Japanese retailer, confirmed that customer and supplier data was exposed after a ransomware attack disrupted its e-commerce operations, affecting platforms including Askul, Lohaco, and Soloel Arena.
A political data leak in Hungary raised concerns after personal details of about 200,000 Tisza Party sympathizers appeared online, demonstrating how cyber attacks are increasingly weaponized in political contexts.
Crypto & DeFi Targeted
The $120 million Balancer DeFi hack highlighted the growing maturity of crypto-focused threat actors who continue to exploit logic flaws in widely used protocols. Decentralized finance platforms remain attractive targets due to the difficulty of recovering stolen cryptocurrency.
What 2025 Data Tells Us About Risk
Analysis of 2025 reveals critical patterns that should inform every organization’s security strategy as we head into 2026:
Geographic Concentration
The United States remains the epicenter of ransomware activity, accounting for approximately 21% of global attacks targeting critical infrastructure. This concentration reflects both the economic value of U.S. targets and their digital maturity.
Following the U.S., the most targeted nations include:
- Canada
- Germany
- United Kingdom
- Italy
Sector Vulnerability Rankings
Manufacturing’s 61% increase in attacks placed it at the top of the vulnerability list, but other sectors face severe exposure:
- Healthcare: Consistently high-value target due to sensitive data and low tolerance for downtime
- Financial Services: Direct monetization opportunities and valuable transactional data
- Technology: Supply chain leverage and access to downstream victims
- Retail: Large customer databases and complex, integrated systems
The SMB Reality Check
Small and mid-sized businesses became the new frontline in 2025. Attackers increasingly favor targets with $4M-$8M in revenue, where defenses are thinner and risks of retaliation lower.
Mastercard’s global SMB cybersecurity study revealed that nearly one in five SMBs that suffered a cyberattack filed for bankruptcy or had to close. The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses experienced a cybersecurity breach or attack in the past year.
For SMBs, ransomware isn’t just a security problem—it’s an existential threat.
The Supply Chain Multiplication Effect
One of 2025’s most significant developments was the continued rise of supply chain warfare, where attacks on vendors cause disruption far beyond the initial breach.
Case Study: The Miljödata Catastrophe
The August 2025 ransomware attack on Swedish HR software provider Miljödata represents one of the most disruptive supply chain attacks to hit Europe:
- 870,000+ email addresses exposed across Sweden’s public and private sectors
- 80% of Sweden’s municipalities impacted
- At least 25 major corporations affected, including Volvo, SAS, and Boliden
- Multiple universities compromised
The DataCarry ransomware group’s attack on this single vendor created a cascading failure affecting hundreds of organizations simultaneously. For Volvo Group North America alone, the breach exposed current and former employee names and Social Security numbers, triggering regulatory notifications and 18 months of free identity protection services.
The Vendor Risk Reality
Third-party compromises now represent a significant percentage of successful attacks:
- Cleo Managed File Transfer vulnerabilities (CVE-2024-50623, CVE-2024-55956) led to 154 CL0P ransomware incidents in Q1 2025 alone
- Salesforce-based systems became attack vectors for breaches affecting Toyota, Disney, McDonald’s, HBO Max, and insurance companies
- Cloud provider compromises like the Oracle incident in November affected multiple enterprise customers simultaneously
Organizations must recognize that their security perimeter extends to every vendor with access to their systems or data. As security researcher Marcus Hutchins noted: “You’re only as secure as your weakest vendor.”
The Legal and Regulatory Landscape Shifts
While ransomware attacks surge, the legal framework surrounding data breaches is undergoing a significant transformation that affects organizational liability and victim recourse.
The “No Harm, No Foul” Doctrine
Following the Supreme Court’s TransUnion v. Ramirez decision, courts throughout 2025 have been increasingly dismissing data breach cases where plaintiffs cannot demonstrate tangible, traceable injuries from exposed personal data.
The Ninth Circuit’s decision in Greenstein v. Noblr established an even higher bar: a general notice that personal information “may have been exposed” without confirmation that specific plaintiff’s information was stolen is not sufficient to establish standing.
This shift represents a significant victory for businesses facing breach-related lawsuits, but raises important questions about accountability:
- Reduced litigation risk: Companies may face fewer successful lawsuits if affected individuals cannot prove concrete harm
- Higher burden on victims: Plaintiffs must now demonstrate traceability between specific breaches and fraudulent activity
- Mitigation cost questions: Courts remain divided on whether spending money to mitigate breach risks constitutes sufficient injury
OFAC Complications
The U.S. Treasury’s Office of Foreign Assets Control (OFAC) prohibits transactions with sanctioned entities, which include many major ransomware gangs. OFAC’s official position is a “presumption of denial” for any request to pay a sanctioned group.
This creates a strict liability trap: organizations can face massive fines even if they didn’t know the attacker was on the sanctions list. General counsel must be a key part of incident response planning from day one.
State-Level Fragmentation
With all 50 U.S. states having enacted unique breach notification laws, compliance has become increasingly complex. Key variations include:
- Notification timing: Some states allow “reasonable” time, others demand action within 30 days (FISMA requires 1-hour notification for federal agencies)
- Ransomware coverage gap: Only Connecticut and New Jersey require notification based on access alone
- Credit monitoring mandates: States increasingly require 12-24 months of free monitoring services
- Encryption safe harbors: Standards vary from 128-bit to 256-bit AES encryption requirements
Organizations operating across state lines must navigate this patchwork of requirements, with the risk that delayed notification in one state triggers penalties even if compliant with others.
What This Means for Organizations: The 2026 Defense Playbook
Given the dramatic evolution in ransomware tactics and economics throughout 2025, traditional security strategies are no longer sufficient. Organizations must adopt a comprehensive approach centered on proactive resilience:
1. Aggressively Manage Your Attack Surface
Run a tight ship. Attackers are scanning constantly for exposed vulnerabilities:
- Patch aggressively, especially on internet-facing systems
- Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog
- If you don’t need a port open to the internet, close it
- Implement vulnerability management automation to reduce patch windows from weeks to hours
2. Adopt Zero Trust Architecture
The old model of “trust but verify” is dead. The new model is “never trust, always verify”:
- Assume every user and device could be compromised
- Implement identity-first segmentation based on user identity and role
- Use contextual access enforcement based on identity, risk, and behavior
- Ensure better containment when ransomware hits identity-linked services
3. Make Your Backups Unbreakable
Your backups are your last line of defense, but they’re also the attackers’ primary target:
- Backups should be immutable (cannot be modified or deleted)
- Isolated from the main network (air-gapped or cloud-secured)
- Tested relentlessly so you can actually restore from them
- Pre-stage gold images for rapid bare-metal recovery when cleanup would take too long
4. Prioritize Data Exfiltration Detection
With 76% of attacks involving data theft before encryption, you cannot rely on ransomware deployment as the breach signal:
- Deploy Data Loss Prevention (DLP) technologies
- Monitor for unusual data transfers, especially to external destinations
- Use canary documents with telemetry for breach detection
- Seed fake documents (financial spreadsheets, HR files) across key shares to trigger alerts
5. Lock Down the Help Desk
Help desk scams are a critical attack vector for groups like Scattered Spider:
- Train help desk staff to recognize common social engineering techniques
- Enforce strict verification for password and MFA resets
- Be wary of “emergency” reset requests
- Implement out-of-band verification for sensitive account changes
6. Master Vendor Risk Management
Third-party compromises now represent a significant percentage of successful attacks:
- Continuously assess third-party security posture
- Require vendors to meet minimum security standards
- Implement contractual security requirements with right-to-audit provisions
- Monitor vendor security ratings using tools like SecurityScorecard or BitSight
7. Test Your Incident Response Plan
An untested plan is not a plan. Run regular tabletop exercises and full-scale simulations with all key stakeholders:
- IT and security teams
- Legal counsel
- Executive leadership
- Communications/PR
- Human resources
Have an incident response firm and expert legal counsel on retainer before you need them. When ransomware hits, speed matters—and you don’t want to be researching vendors while your systems are encrypted.
The Road Ahead: Predictions for 2026
Based on 2025 trends and emerging threat intelligence, several developments appear likely:
Continued Ecosystem Fragmentation
The ransomware landscape will remain highly fragmented, with dozens of smaller groups replacing the dominant syndicates that law enforcement has disrupted. This fragmentation makes the threat landscape less predictable but no less dangerous.
AI-Enabled Attacks
Generative AI will continue making it easier for attackers to:
- Craft convincing phishing lures
- Automate reconnaissance and vulnerability scanning
- Create deepfake videos and audio for social engineering
- Generate polymorphic malware that evades signature-based detection
Cloud-Native Threats
Expect more attacks like Codefinger that exploit cloud platforms’ own features:
- Serverless function abuse
- API key compromise and privilege escalation
- Container escape techniques
- Multi-cloud lateral movement
Regulatory Escalation
As breaches continue to surge, governments will likely:
- Mandate stronger security controls for critical infrastructure
- Increase penalties for non-compliance with breach notification requirements
- Expand OFAC sanctions on ransomware payment processing
- Require cybersecurity insurance or financial reserves
The Rise of Cyber Catastrophe Bonds
As ransomware costs escalate, expect the emergence of catastrophic cyber insurance instruments similar to natural disaster bonds, allowing organizations and insurers to transfer extreme cyber risk to capital markets.
Conclusion: Beyond “If” to “When” and “How Well”
The November 2025 breach landscape reinforces a sobering reality that security professionals have known for years: it’s not a question of if your organization will face a cyber incident, but when—and whether you’ll be prepared to detect, contain, and respond effectively.
The ransomware revolution of 2025 has fundamentally changed the threat equation:
- Volume has replaced precision as the dominant attacker strategy
- Data theft has overtaken encryption as the primary extortion mechanism
- Third-party risk has become first-party risk through supply chain attacks
- Cloud platforms have become primary battlefields requiring new defensive strategies
- Legal protections for victims are eroding while regulatory requirements expand
Organizations that continue treating cybersecurity as an IT problem rather than an enterprise risk management imperative will find themselves increasingly vulnerable. The threat actors have industrialized their operations; defenders must do the same.
The question for 2026 is not whether ransomware will continue to evolve—it will. The question is whether organizations will evolve their defenses fast enough to stay ahead of an adversary that operates at the speed of software.
As one incident responder told us after a particularly devastating attack: “We had all the security tools. We just didn’t have them configured right, tested regularly, or integrated into our business processes. The attackers didn’t beat our technology—they beat our organizational discipline.”
That’s the real lesson of the 2025 ransomware revolution: Technology alone cannot save you. Only organizational commitment to security-first culture can.
Stay Informed
Want to stay ahead of breach trends and emerging threats? Follow breached.company for daily breach intelligence, in-depth analysis, and actionable security insights.
Related Articles:
- November 2025 Breach Wrap-Up: Who Got Hit
- INC Ransom: The Ransomware Group That Abandoned All Ethical Boundaries
- The Insurance Industry Under Siege
- Volvo Group North America: 870,000+ Accounts Exposed
- The Rising Bar: Data Breach Litigation in 2025
- Critical Alert: Actively Exploited Vulnerabilities
Author’s Note: This analysis synthesizes data from multiple threat intelligence sources, government agencies, and security research organizations. Statistics and trends cited represent the best available information as of December 2025. The threat landscape continues to evolve rapidly, and organizations should supplement this analysis with real-time threat intelligence feeds and sector-specific security guidance.
