Ransomware Incidents Rose 49% in 2025, Exposing Backup Gaps

Key Takeaways

• Public disclosures and leak-site data indicate that ransomware remains substantially underreported.
• Unpatched vulnerabilities, inconsistent backup readiness, and weak access controls continue to increase exposure.
• Recovery depends on layered defenses, tested restoration procedures, and business-level incident planning.

Ransomware has become less of a discrete malware problem and more of an enterprise resilience test. Attackers increasingly combine encryption with data theft, threatening to publish sensitive information even when a victim can restore its systems. That double-extortion model places legal, operational, financial, and reputational pressure on executives at the same time.

The scale is difficult to measure because many incidents remain private. BlackFog recorded 1,174 publicly disclosed ransomware incidents in 2025, a 49% year-over-year increase. Another 7,079 victims appeared on criminal leak sites. The gap between those figures suggests that public announcements capture only part of the activity facing businesses, government agencies, healthcare providers, and other institutions.

Costs remain substantial as well. A vendor-agnostic survey of 3,400 organizations in 17 countries put the average ransom payment at $1.0 million and the average recovery cost at $1.5 million. Recovery spending can include forensic investigations, system rebuilding, outside counsel, customer notifications, operational disruption, and additional security controls. The ransom, in other words, may be only one line on a much larger bill.

Many attacks still begin through preventable weaknesses. Unpatched vulnerabilities were the leading reported cause of ransomware incidents in 2025, accounting for 32% of cases. Malicious email and stolen credentials also remain useful entry points. Once inside, attackers may move laterally, elevate privileges, disable security tools, locate backups, exfiltrate information, and then launch encryption across connected systems.

Manufacturing illustrates the operational stakes. Comparitech counted 1,466 manufacturing ransomware attacks in 2025, an increase of 56%. Production environments can be especially attractive because downtime has an immediate cost. A disrupted identity service, scheduling platform, warehouse system, or production network can halt physical operations far beyond the initially compromised device.

Backups should provide a way out, but the evidence shows uneven preparedness. Only 54% of organizations used backups to restore data after ransomware in 2025. That does not necessarily mean the rest lacked backups. Some copies may have been encrypted, deleted, incomplete, too slow to restore, or unable to support the organization’s recovery objectives. A backup that has not been tested under realistic conditions is still an open question.

Rapid vulnerability remediation is a practical starting point, particularly for internet-facing systems. Phishing-resistant multifactor authentication can reduce exposure to stolen passwords, while least-privilege access can restrict what compromised accounts are able to reach. Network segmentation can also limit lateral movement between user, server, cloud, and operational technology environments.

Endpoint detection and response products such as Microsoft Defender for Endpoint, CrowdStrike Falcon, and Sophos Intercept X can help identify malicious behavior. Still, no individual product covers the entire attack path. Centralized logging, protected administrative accounts, egress monitoring, offline or immutable backups, and rehearsed incident-response procedures provide additional layers. Small details matter here, including whether responders can communicate when corporate email and identity systems are unavailable.

The updated NIST IR 8374 Rev. 1 maps ransomware risk management to NIST Cybersecurity Framework 2.0. That approach can help organizations treat ransomware as an enterprise risk rather than a security-team-only concern. Boards and senior leaders can use it to clarify ownership, determine which operations receive restoration priority, and establish decision paths for legal, regulatory, insurance, and law-enforcement engagement.

Preparation must extend beyond a written plan. Organizations benefit from restoration exercises that measure how long critical services actually take to recover, whether clean credentials are available, and whether backup data is usable. Tabletop exercises should include executives, communications teams, legal counsel, business operators, and technology leaders. The uncomfortable question is worth asking early: if core systems went dark tonight, who would have authority to make the first ten decisions?

Ransomware operators continue to exploit the distance between having security controls and proving those controls work under pressure. Closing that gap involves routine patching, constrained access, useful telemetry, isolated recovery copies, and repeated practice. The objective is not merely to stop encryption. It is to keep a serious intrusion from becoming a prolonged business crisis.