Sector research records 1,174 publicly disclosed ransomware attacks during 2025, a 49% increase year on year, with 22% of them targeting medical organisations.
The Corpus Now Holds Four Incompatible Totals For One Year
At 25-1230 this desk recorded two trackers reporting 7,458 victims (+30%) and 7,307 (+45%), and noted that the totals nearly agreed while the growth rates did not — meaning the disagreement was about 2024, measured at the time by the same organisations.
A third analysis cited 8,159 and +49%. This one reports 1,174 and +49%.
Eleven hundred against seven or eight thousand is not a methodological quibble. These are counting different objects: attacks against victims, disclosed-by-whom, over what population. None of the sources this desk reviewed states which.
The Growth Rates Converging Is The Odd Part
Two of the four report +49% from entirely different bases. That could indicate a real underlying trend robust to methodology, or it could indicate that a headline percentage circulated and was adopted.
This desk cannot distinguish between them, and records the coincidence because the corpus should be as suspicious of numbers that agree for no visible reason as of numbers that disagree.
Graded Low, And It Is The Fourth Time
The corpus has now filed 25-1230, 25-0423, 25-0821 and this file on the same problem: sector totals published without the definition of the unit being counted.
The direction across all of them is consistent and probably right. Any specific figure quoted from any of them is measuring an instrument. That is as much as this database can honestly say about how much ransomware happened in 2025.
Built on published sector research, listed below, read against the other 2025 totals recorded in this database. No source states its counting unit. Corrections: corrections@forensicpost.com.
- Ransomware in healthcare: the attack timelineCybelAngel
- Record number of ransomware victims and groups in 2025Infosecurity Magazine