One anonymity service shared by 25 ransomware groups, watched for three years before seizure. The observation window has victims in it.
Most victims had no opportunity to behave differently. The failure was entirely at the carrier, and awareness training addresses none of it.
The totals nearly agree and the growth rates do not — which means the disagreement is about 2024, measured at the time by the same organisations.
This desk files the enterprise version as adversary tradecraft and the consumer version as carelessness. That distinction does not survive the comparison.
Where disclosure is not mandatory, the regional picture is assembled almost entirely from what attackers chose to publish.
An operator optimising for revenue keeps negotiations separate. Branding them together does the reverse.
Automation, mining, peripherals, a newspaper. The vulnerability selected the victims, and the attacker learned afterwards who they were.
A fivefold rise is affiliate recruitment, not innovation. Which makes affiliate confidence the scarce asset worth attacking.
Three hundred files describe organisations losing data. This is the other end — and there is no bridge between them.
Nobody targeted a newsroom. A media organisation cannot scope its security to the systems that obviously hold journalism.
The harms that get counted are the ones somebody already had a process for. Biometrics and medical history generate no report at all.
The window between disclosure and exploitation is shortest exactly where the ability to respond is slowest.
One ERP zero-day, 29 named victims across unrelated sectors, nothing encrypted. Theft-and-publication at industrial scale.
A regulator receiving a dozen filings describing the same technique could warn the market. That is not a new obligation — it is a use of filings that already exist.
The published “we don’t hit hospitals” rules were positioning. An operation whose affiliates pick the victims cannot implement a sector exclusion.
Credit monitoring is a product designed for the population that files the most reports — and useless against a persuasive phone call about savings.
A figure that can only be an undercount. Those are the most useful numbers in this database and there are very few of them.
“Group X has been dismantled” is the form the good news usually takes in this field. It describes the destruction of the cheapest component.
Internet-facing, authentication-heavy, holding the files too sensitive for email. Managed file transfer keeps producing portfolios of victims.
At better than one in four per year, the burden this industry places on individual vigilance is not one any population could carry.
The practical entitlement reads: you will be told, unless telling you costs more than the organisation has left.
The campaign is unmeasurable. Its individual victims are not.