44% of 2025 Breaches Involved Ransomware and 30% a Third-Party Failure

Sector analysis of 2025 puts around 44% of breaches as involving ransomware and roughly 30% as linked to supply-chain or third-party failure, against an estimated global cybercrime cost in the region of $10.5 trillion.

Treat the cost figure with considerable caution — it is a modelled aggregate with contested methodology, and it circulates far more widely than its derivation supports. The composition figures are the useful part.

Almost a third of breaches originating with a third party means the boundary an organisation defends is no longer the boundary that determines its exposure.

The 2025 files in this database are dominated by exactly that: Collins Aerospace at 25-0919, Salesloft at 25-0818, the Oracle EBS campaign at 25-0930, SonicWall at 25-0917. In each, the compromised party and the affected parties were different organisations.

Presenting ransomware and supply chain as separate percentages implies they are separate phenomena. Frequently they are the same incident counted twice — the Cl0p campaign was a supply-chain exploitation executed by a ransomware group that deployed no ransomware.

That taxonomy problem is worth naming, because it means neither figure can be read as a share of a clean partition, and comparing them year to year compares definitions as much as events.

Three things this desk has since filed repeatedly for 2026 have their origin in 2025 incidents: identity-led access replacing exploitation, extortion without encryption, and concentration at suppliers converting one intrusion into hundreds of victims.

None of those was new in 2025. What 2025 provided was the scale that made them undeniable — and it is why backfilling this year matters for anyone reading the 2026 files.