Ransomtracker · year archive
Ransomware attacks in 2025: 8,835 victims listed on leak sites
In 2025, ransomware operators listed 8,835 victims on their leak sites in 2025, across 140 operations and 126 countries where a location could be read from the listing. That is 46.4% more than 2024 (6,034). Qilin was the most active operator with 1,029 listings (11.6% of the year), and October was the busiest month with 1,029. Every entry is an operator claim as published on a leak site, not a verified incident.
By month
Victims listed per month in 2025
Stacked by the five operators with the most listings in the year.
| Month | Listings | vs previous month | Most active operator |
|---|---|---|---|
| January 2025 | 696 | – | Babuk-bjorka 69 |
| February 2025 | 1,004 | +308 | Cl0p 345 |
| March 2025 | 809 | −195 | Babuk-bjorka 125 |
| April 2025 | 672 | −137 | Akira 69 |
| May 2025 | 502 | −170 | SafePay 72 |
| June 2025 | 520 | +18 | Qilin 83 |
| July 2025 | 622 | +102 | Qilin 64 |
| August 2025 | 551 | −71 | Qilin 87 |
| September 2025 | 654 | +103 | Qilin 84 |
| October 2025 | 1,029 | +375 | Qilin 190 |
| November 2025 | 769 | −260 | Cl0p 110 |
| December 2025 | 1,007 | +238 | Qilin 174 |
Busiest single day: 24 February 2025 with 263 listings. Listings were recorded on 358 of the 365 days. Masked or placeholder victim names: 136.
Operators
Which ransomware groups were most active in 2025?
The 25 operators with the most leak-site listings in 2025. Names link to full operator profiles.
| # | Operator | Listings | Share | Last listing |
|---|---|---|---|---|
| 1 | Qilin | 1,029 | 11.6% | 31 Dec 2025 |
| 2 | Akira | 640 | 7.2% | 26 Dec 2025 |
| 3 | Cl0p | 549 | 6.2% | 19 Dec 2025 |
| 4 | Play | 385 | 4.4% | 31 Dec 2025 |
| 5 | SafePay | 380 | 4.3% | 29 Dec 2025 |
| 6 | INC Ransom | 369 | 4.2% | 31 Dec 2025 |
| 7 | Killsec3 | 293 | 3.3% | 25 Dec 2025 |
| 8 | Lynx | 271 | 3.1% | 26 Dec 2025 |
| 9 | RansomHub | 236 | 2.7% | 1 Apr 2025 |
| 10 | DragonForce | 222 | 2.5% | 29 Dec 2025 |
| 11 new | Babuk-bjorka | 213 | 2.4% | 4 Apr 2025 |
| 12 new | Devman2 | 183 | 2.1% | 28 Dec 2025 |
| 13 new | Sinobi | 173 | 2.0% | 23 Dec 2025 |
| 14 | Medusa | 158 | 1.8% | 30 Dec 2025 |
| 15 | Everest | 141 | 1.6% | 31 Dec 2025 |
| 16 new | NightSpire | 139 | 1.6% | 30 Dec 2025 |
| 17 new | World Leaks | 115 | 1.3% | 24 Dec 2025 |
| 18 new | LockBit 5 | 110 | 1.2% | 30 Dec 2025 |
| 19 | Funksec | 96 | 1.1% | 19 Mar 2025 |
| 20 | Rhysida | 94 | 1.1% | 30 Dec 2025 |
| 21 | Cactus | 94 | 1.1% | 17 Mar 2025 |
| 22 | Leakeddata | 90 | 1.0% | 7 Oct 2025 |
| 23 new | Nova | 88 | 1.0% | 29 Dec 2025 |
| 24 | Kairos | 88 | 1.0% | 19 Dec 2025 |
| 25 | Sarcoma | 82 | 0.9% | 20 Nov 2025 |
new marks an operator whose first listing in the Ransomtracker index falls in 2025. Rebrands (Conti to Black Basta, Royal to BlackSuit and so on) are counted under the name on the leak site at the time; lineage is annotated on the profiles.
Countries
Where were the victims listed in 2025?
Victim country where the operator’s own text, the victim’s domain or a recognisable city gave it away.
How much of the year could be placed
A country was identified for 32.1% of the 8,835 listings; 6,001 name no location and are not in the ranking. 126 countries appear at least once. Operators who write descriptions are over-represented, so read the ranking as a floor, not a census.
The live tracker carries the trailing-12-month map; verified incidents by country are on the confirmed attacks pages.
Context
How 2025 compares with other years
Leak-site listings per year in the Ransomtracker index. Earlier years are less complete: coverage of leak sites has widened every year, so part of the growth is measurement.
| Year | Victims listed | Change | Operators with listings |
|---|---|---|---|
| 2022 | 4,562 | – | 61 |
| 2023 | 5,422 | +18.9% | 71 |
| 2024 | 6,034 | +11.3% | 102 |
| 2025 | 8,835 | +46.4% | 140 |
| 2026 (to date) | 8,553 | year in progress | 168 |
FAQ
Frequently asked questions
How many ransomware attacks were there in 2025?
Ransomtracker recorded 8,835 victims listed on ransomware leak sites in 2025. These are operator claims as published, so they overstate confirmed incidents (some are duplicated, inflated or fabricated) and understate the real total (victims who pay quietly are never listed).
Which ransomware group was most active in 2025?
Qilin, with 1,029 listings, 11.6% of all leak-site victims in 2025, ahead of Akira (640) and Cl0p (549).
Which month had the most ransomware attacks in 2025?
October 2025, with 1,029 leak-site listings, 190 of them by Qilin.
Which country had the most ransomware victims in 2025?
The United States, with 969 identified victims, 34.2% of the listings that could be placed in a country. A country could be read for 32.1% of listings, so the ranking is indicative.
Were there more ransomware attacks in 2025 than in 2024?
Yes: 8,835 listings in 2025 against 6,034 in 2024, a change of +46.4%.
Are these confirmed ransomware attacks?
No. Ransomtracker indexes what operators publish on their leak sites; nothing here is verified by Ransomnews. The separately maintained confirmed ransomware attacks dataset holds incidents corroborated against breach notifications, filings and press reports.
Data
Download and cite
Every listing behind this page is available as CSV (2025, one row per listing) and the figures above as JSON; a monthly summary CSV covers every year since 2022. Cite as Ransomnews Ransomtracker, with a link to this page. Figures recalculate from the live index; generated 15 October 2026 16:23 UTC.
Method: the collector parses each victim listing as operators publish it and records the organisation named, the operator, the listing time and the operator’s description. Country is a best-effort reading of that text and the victim’s domain. Source data: RansomLook (CC BY 4.0), aggregated, enriched and adapted by Ransomnews. The full methodology and caveats are on the tracker page.