Loading story…
Ransomware continues to be the predominant cause of high-value cyber insurance claims in 2025, with attackers increasingly targeting small and mid-sized businesses as large enterprises bolster their defenses. According to Allianz’s Cyber Security Resilience 2025 report, 88% of breaches at smaller firms involved ransomware, compared to 39% at larger organizations, highlighting a shift in attacker focus toward easier targets. Ransomware accounted for approximately 60% of insurance claims exceeding €1 million in the first half of 2025, underscoring its financial impact. Attackers are evolving their tactics, moving beyond simple encryption to prioritize data exfiltration, which is often less resource-intensive and more likely to result in ransom payments. The value of stolen data is rising, and the average global breach cost is approaching $5 million, with privacy regulations and litigation risks compounding the financial exposure for affected organizations. Social engineering, phishing, and business email compromise remain prevalent, with generative AI making these attacks more convincing and credential abuse now the most common attack vector. Groups such as Scattered Spider exemplify the trend of using social engineering and credential theft to rapidly escalate attacks from account takeover to ransomware deployment. Retailers have become the most targeted sector in early 2025, following manufacturing and professional services in total losses, due to their large volumes of personal data and complex supply chains. Supply chain disruptions are also emerging as a significant source of cyber insurance claims, as interconnected business operations increase systemic risk. The evolving threat landscape is prompting organizations to reassess their cyber resilience strategies, with a focus on proactive defense measures and third-party risk management. The increasing sophistication of attacks, especially those leveraging AI and targeting operational technology, is driving a need for improved governance and contractual protections with suppliers. As attackers adapt, organizations must prioritize both IT and OT security, ensure executive support for resilience initiatives, and address hidden dependencies that could become blind spots in their defenses. The convergence of ransomware, data exfiltration, and supply chain vulnerabilities is shaping the cyber insurance market and influencing security priorities for businesses of all sizes in 2025.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Manufacturers have become the primary target for cyberattacks in 2025, with over half experiencing ransomware incidents and paying significant ransoms, according to industry data. The average ransom payment reached $1 million, and recovery costs excluding ransom approached $1.3 million, highlighting the severe financial impact on the sector. The most common root cause of compromises shifted to exploited vulnerabilities, overtaking malicious emails and compromised credentials from previous years. Experts attribute the sector's vulnerability to a lack of security expertise, unaddressed cybersecurity gaps, and insufficient adoption of protective measures, making operational disruptions both likely and costly. The broader threat landscape in November 2025 was marked by a surge in data theft and ransomware attacks across multiple industries, with high-profile victims including major airlines, media organizations, universities, and healthcare providers. The Cl0p ransomware syndicate alone claimed responsibility for attacks on over 29 organizations, contributing to a global trend of increasing data breaches and extortion. Regulatory and legal pressures are intensifying, raising the stakes for organizations that fail to protect sensitive data. These developments underscore the urgent need for improved cybersecurity maturity, regular incident response testing, and proactive vulnerability management to mitigate the growing risks.
Jun 29, 2026
Ransomware attacks have surged in frequency and sophistication, with organizations facing a dramatic increase in incidents driven by AI-powered attack chains, double- and multi-extortion tactics, and the proliferation of ransomware-as-a-service. Industry surveys and reports highlight that nearly 78% of companies experienced ransomware attacks in the past year, with attack volumes tripling year-over-year and public disclosures rising sharply. Attackers are increasingly leveraging artificial intelligence to accelerate intrusion, encryption, and extortion, rendering traditional detection methods less effective. The financial impact is severe, with average incident costs exceeding $5 million and a significant portion of victims suffering major disruption or data loss, even when ransoms are paid. Security leaders emphasize the urgent need for comprehensive ransomware playbooks, regular tabletop exercises, and enhanced training to build organizational resilience. Despite the growing threat, many organizations remain underprepared, with 76% struggling to keep pace with AI-assisted attacks and 85% acknowledging the obsolescence of legacy detection tools. Experts recommend a shift from reactive to proactive defense, including robust planning, cloud data protection, and continuous improvement of incident response capabilities to mitigate the evolving ransomware landscape.
Jun 29, 2026
Ransomware attacks have reached unprecedented levels globally, with the third quarter of 2025 witnessing a 36% year-over-year increase in publicly disclosed incidents, according to BlackFog’s latest report. The total number of ransomware attacks reported in this period climbed to 270, marking a 335% rise since Q3 2020. These attacks have caused significant operational disruptions across various sectors, including airlines, automotive manufacturers, governments, and organizations in 93 countries. Notable incidents include grounded aircraft, stranded passengers, and manufacturers such as Jaguar Land Rover being forced to halt production, with some operations only recently resuming after prolonged outages. The impact of ransomware extends beyond large enterprises, severely affecting small businesses that often lack the resources and security infrastructure to defend against such threats. Many small business owners have reported devastating financial consequences, with some losing nearly all their savings and seeing their businesses shrink dramatically. The attack on the UK nursery chain Kido in September 2025 highlighted the evolving tactics of ransomware groups, as sensitive data on children, parents, and carers was exfiltrated, raising concerns about the targeting of vulnerable sectors. Ransomware operators are increasingly indiscriminate, targeting organizations of all sizes and types, and seeking leverage through data theft and extortion. The psychological and financial toll on victims is profound, with individuals and organizations facing long-term recovery challenges. Research indicates that small businesses are particularly vulnerable, often lacking dedicated IT security staff, legal support, or sufficient cash reserves to weather the aftermath of an attack. The stress and adversity experienced by victims underscore the need for robust data protection and incident response strategies. Experts emphasize that the best defense is to make it as difficult as possible for cybercriminals to succeed, focusing on data protection to reduce the incentive for extortion. The continued upward trend in ransomware volumes signals an urgent need for organizations to reassess their security postures and invest in preventive measures. The widespread and lasting impact of these attacks demonstrates that ransomware remains one of the most significant threats to global business continuity and data security. Organizations are urged to prioritize anti-data exfiltration technologies and comprehensive incident response planning. The evolving threat landscape requires constant vigilance and adaptation to new attacker tactics. The experiences of both large enterprises and small businesses illustrate the far-reaching consequences of ransomware, from operational shutdowns to personal financial ruin. As attackers become more aggressive and sophisticated, the imperative for proactive defense and resilience has never been greater.
Jun 29, 2026