Loading story…
Ransomware activity has reached unprecedented levels in 2025, with a significant increase in both the number of victims and the proliferation of ransomware groups. According to a mid-year report by Searchlight Cyber, 3,734 victims were listed on public extortion sites from January through June, marking a 20% rise over the previous half-year and a 67% increase compared to the same period in 2024. This surge is largely attributed to the Ransomware-as-a-Service (RaaS) model, which allows core groups to rent out their tools to affiliates, thereby expanding their operational reach. The report identified 88 active ransomware groups in the first half of 2025, up from 76 in late 2024, with 35 of these being entirely new entities. This constant turnover, with groups frequently merging, splitting, or rebranding, complicates efforts to track and attribute attacks. Affiliates often move between groups, ensuring that even when a group dissolves, its members remain active in the ransomware ecosystem. The evolving landscape has also led to changes in attack tactics, with groups increasingly relying on data exfiltration and extortion rather than just encryption, as improved backup and restoration capabilities have reduced the effectiveness of traditional ransomware. The emergence of new, aggressive groups such as the Radiant Group exemplifies this trend. Radiant Group recently targeted Kido International, a preschool and daycare provider, leaking highly sensitive data including images, names, and addresses of children, as well as contact details of their parents. This attack, which affected UK-based families, demonstrates the extreme lengths to which some groups will go to pressure victims, including publishing personal data and threatening to contact regulators and associates. The Radiant Group’s tactics are among the most aggressive seen, and their willingness to target vulnerable populations highlights the ethical depravity of some actors in the ransomware space. The group operates without affiliates and has described itself as financially motivated, engaging in both double- and single-extortion attacks. The incident at Kido International has drawn attention from cybersecurity experts, who stress the responsibility of organizations holding sensitive data to implement robust security measures. The rapid evolution of ransomware tactics and the increasing number of groups present a growing challenge for defenders, who must continually adapt their strategies. Law enforcement and regulatory bodies have been notified of the Kido International breach, but responses are still pending. The overall trend indicates that ransomware will remain a dominant and evolving threat, with attackers becoming more brazen and innovative in their extortion methods. Organizations across all sectors, especially those handling sensitive personal data, are urged to strengthen their defenses and incident response plans. The combination of technical innovation, organizational churn, and aggressive extortion tactics underscores the complexity and severity of the current ransomware threat landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The incident was reported to the Information Commissioner's Office, indicating regulatory notification in the UK. This was disclosed in coverage of the breach as scrutiny of the handling of children's data intensified.
Kido International informed parents that it was aware of the breach and contacted them about the incident while an investigation was underway. Affected parents later confirmed to reporters that the organization had already notified them.
According to reporting cited in the references, the attackers directly contacted some parents and urged them to get the nursery chain to pay, escalating the extortion beyond the victim organization. This raised concerns about follow-on extortion and harassment of affected families.
To prove access and pressure Kido, Radiant posted sample data on its dark web leak site, including images and profiles of 10 children along with associated family details. Multiple reports described this as an unusually aggressive extortion tactic and noted it was the first leak posted on the group's site.
A ransomware group calling itself Radiant allegedly compromised Kido International, a preschool and daycare organization, and stole sensitive data relating to nearly 8,000 children and their parents or carers. Reported data types include names, photos, home addresses, dates of birth, and in some accounts safeguarding or medical information.
5 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcehelpnetsecurity.com
Open sourcemalwarebytes.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity surged in 2025 despite significant law enforcement actions against major ransomware-as-a-service (RaaS) groups, with new groups quickly filling the void and victim numbers reaching record highs. Data from RansomLook.io and Ransomware.live showed a sharp increase in claimed ransomware victims, with global numbers rising from approximately 5,400 in 2023 to over 8,000 in 2025. Attackers increasingly relied on social engineering rather than technical exploits, and the impact of ransomware was felt across all sectors, including retail, education, government, and healthcare. Notable incidents included coordinated campaigns against major UK retailers and disruptive attacks on organizations such as Coupang, University of Phoenix, and the NHS’s technology provider DXC Technology. The year’s most significant attacks demonstrated the systemic and cross-sector nature of modern cyber risk, with attackers exploiting third-party dependencies and identity weaknesses to maximize disruption. High-profile breaches led to operational outages, data exposure, and substantial financial and reputational damage, as seen in the case of Marks & Spencer, which suffered a dramatic drop in profits following a ransomware campaign attributed to the Scattered Spider group. These incidents have prompted organizations to reassess their incident response strategies, invest in ransomware readiness, and strengthen supply chain security as they prepare for evolving threats in 2026.
Jun 29, 2026
Ransomware attacks have reached unprecedented levels globally, with the third quarter of 2025 witnessing a 36% year-over-year increase in publicly disclosed incidents, according to BlackFog’s latest report. The total number of ransomware attacks reported in this period climbed to 270, marking a 335% rise since Q3 2020. These attacks have caused significant operational disruptions across various sectors, including airlines, automotive manufacturers, governments, and organizations in 93 countries. Notable incidents include grounded aircraft, stranded passengers, and manufacturers such as Jaguar Land Rover being forced to halt production, with some operations only recently resuming after prolonged outages. The impact of ransomware extends beyond large enterprises, severely affecting small businesses that often lack the resources and security infrastructure to defend against such threats. Many small business owners have reported devastating financial consequences, with some losing nearly all their savings and seeing their businesses shrink dramatically. The attack on the UK nursery chain Kido in September 2025 highlighted the evolving tactics of ransomware groups, as sensitive data on children, parents, and carers was exfiltrated, raising concerns about the targeting of vulnerable sectors. Ransomware operators are increasingly indiscriminate, targeting organizations of all sizes and types, and seeking leverage through data theft and extortion. The psychological and financial toll on victims is profound, with individuals and organizations facing long-term recovery challenges. Research indicates that small businesses are particularly vulnerable, often lacking dedicated IT security staff, legal support, or sufficient cash reserves to weather the aftermath of an attack. The stress and adversity experienced by victims underscore the need for robust data protection and incident response strategies. Experts emphasize that the best defense is to make it as difficult as possible for cybercriminals to succeed, focusing on data protection to reduce the incentive for extortion. The continued upward trend in ransomware volumes signals an urgent need for organizations to reassess their security postures and invest in preventive measures. The widespread and lasting impact of these attacks demonstrates that ransomware remains one of the most significant threats to global business continuity and data security. Organizations are urged to prioritize anti-data exfiltration technologies and comprehensive incident response planning. The evolving threat landscape requires constant vigilance and adaptation to new attacker tactics. The experiences of both large enterprises and small businesses illustrate the far-reaching consequences of ransomware, from operational shutdowns to personal financial ruin. As attackers become more aggressive and sophisticated, the imperative for proactive defense and resilience has never been greater.
Jun 29, 2026
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026