FBI Records 3,611 Ransomware Complaints as New Jersey Risk Grows

Key Takeaways

• The FBI recorded 3,611 ransomware complaints and $32.3 million in reported losses during 2025.
• Healthcare led critical-infrastructure targeting, increasing the exposure facing New Jersey providers and their technology partners.
• Tested backups, stronger identity controls and rehearsed response plans can limit operational and data-breach damage.

Ransomware remains a material business risk for New Jersey’s healthcare providers, public agencies, schools and private companies, according to national figures that offer the clearest available benchmark for the state.

The FBI’s Internet Crime Complaint Center recorded 3,611 ransomware complaints in 2025, an increase from 3,156 in 2024. Reported ransomware losses reached $32.3 million, according to a McDonald Hopkins review of the FBI IC3 2025 Annual Report.

Those figures do not isolate incidents in New Jersey, so they should not be treated as a state-level attack count. They do, however, show the scale and direction of the broader threat environment in which New Jersey organizations operate.

More than 2,100 reported ransomware incidents during 2025 involved U.S. critical-infrastructure organizations. Government, healthcare, manufacturing and financial services were among the affected sectors. Each has a substantial presence in New Jersey, along with interconnected suppliers, software providers and professional-services firms.

Healthcare and public health faced the greatest reported pressure. The sector recorded 278 ransomware attacks in 2025, making it the most targeted critical-infrastructure category, according to TechTarget.

That exposure has consequences beyond encrypted servers. An attack can interfere with scheduling, billing, patient communications, laboratory workflows and access to clinical records. If attackers also steal personally identifiable information before deploying ransomware, the event can develop into a data breach with identity-theft and privacy implications.

The $32.3 million loss figure captures only part of the economic damage. Downtime, restoration work, legal review, customer notifications and longer-term remediation are not fully represented. Incidents reported directly to FBI field offices may also sit outside the complaint figures, GovTech reported.

For business leaders, that makes ransom demands a poor stand-in for total risk. How much revenue or public service capacity would disappear if core systems were unavailable for several days? The answer depends on operational dependencies, not simply the amount demanded by an attacker.

The threat is also fragmenting. Investigators identified 63 new ransomware variants during 2025. Prominent operations included Akira, Qilin, Lynx/Sinobi, BianLian and Play. Multiple variants matter because organizations are not defending against a single technique or group. Initial access can involve compromised credentials, exposed remote services, phishing or unpatched vulnerabilities, followed by data theft and encryption.

Products from CrowdStrike, Microsoft Defender and Palo Alto Networks can support endpoint monitoring, detection and incident response. Still, deploying a security product is not the same as establishing resilience. Coverage gaps, weak configurations and delayed alert handling can leave room for attackers.

A practical response starts with identity. Multifactor authentication can reduce the value of stolen passwords, particularly for remote access, administrative accounts and cloud services. Privileged access should be limited, monitored and reviewed regularly. Dormant accounts deserve attention too. They are easy to overlook and potentially useful to an intruder.

Backups are another dividing line. Organizations benefit from maintaining isolated or immutable copies, testing restoration procedures and documenting which systems should return first. A backup that has not been restored in a realistic exercise remains an assumption, not a dependable recovery capability.

CISA’s StopRansomware guidance and the NIST Cybersecurity Framework 2.0 provide useful structures for prevention, detection, response and recovery. New Jersey organizations can use them to assess vulnerability management, incident escalation, third-party access and communications planning without treating compliance as the finish line.

That said, preparation reaches beyond the security team. Executives, legal counsel, communications staff, operations leaders and outside responders should understand their roles before an incident. Schools and smaller public bodies may also need shared services or specialist partners where internal staffing is limited.

Ransomware economics favor disruption and uncertainty. New Jersey organizations can shift that balance by shortening detection time, restricting attacker movement and practicing recovery under pressure. The goal is not a claim of perfect protection. It is a business that can identify an intrusion, contain it and keep essential services moving.