Loading story…
Ransomware continued to cause substantial harm to Dutch organizations in 2025, with attackers encrypting systems and increasingly stealing data for double extortion; some campaigns now steal data without deploying encryption. Dutch authorities warn that backups and cyber insurance do not eliminate the operational, financial, and privacy impact, and urge victims to report every incident—including those involving ransom payments—to police. Information sharing under the public-private Project Melissa partnership provided monthly visibility into ransomware incidents affecting the Netherlands and supports investigations, potential decryption opportunities, and suspect identification.
The threat remains driven primarily by preventable access failures rather than novel techniques: exploitation of unpatched vulnerabilities and compromised accounts are the leading intrusion paths. Earlier Dutch assessments recorded 178 successful ransomware attacks in 2023 affecting hundreds of organizations and millions of individuals; two-thirds of 90 examined victims lacked sufficient fundamentals such as MFA, strong password controls, timely patching, and network segmentation. Organizations should prioritize these controls, maintain tested and segregated backups, prepare and exercise incident-recovery procedures, and avoid paying ransoms, as payment neither guarantees recovery nor prevents further extortion.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
The 2025 ransomware overview found that many incidents combined encryption with theft of data for double extortion, while some actors extorted victims using stolen data without encrypting systems. Attacks affected systems, data stores, backups, removable media, and cloud-hosted data.
During 2025, the NCSC, Dutch Police, Public Prosecution Service, Cyberveilig Nederland, and private partners exchanged ransomware-incident information monthly under Project Melissa. The exchange was intended to improve visibility into the frequency and methods of attacks affecting Dutch organizations.
A Project Melissa-enabled analysis of ransomware attacks in the Netherlands during 2024 found no evidence of new ransomware deployment techniques. Exploitation of software vulnerabilities and account takeover remained the principal initial-access methods.
Among Dutch organizations hit by ransomware in 2023, 58% lacked a backup and 18% paid a ransom. The reported payment rate was below the cited global average of 46%.
The Dutch Data Protection Authority recorded 178 unique successful ransomware attacks in 2023, affecting hundreds of organizations and personal data belonging to millions of people. One incident affected more than 200 organizations simultaneously and involved data on 2.5 million people in the Netherlands.
Project Melissa identified an estimated 147 unique ransomware incidents involving Dutch organizations with more than 100 employees in 2023. Exploited vulnerabilities accounted for about 30% of initial access, while unauthorized logins accounted for 28%.
The public-private Project Melissa collaboration between Dutch law-enforcement, cybersecurity authorities, and private-sector partners began to improve information sharing and coordinated action against ransomware and cybercrime.
The Digital Trust Center became part of the Dutch National Cyber Security Centre.
The AP examined 90 organizations affected by ransomware and found that two-thirds had not adequately implemented baseline security measures, including multifactor authentication, sound password policies, timely patching, and network segregation. Nearly half said their incident involved double extortion.
The Melissa covenant established legal, organizational, and technical arrangements for structural public-private collaboration against ransomware and cybercrime in the Netherlands. The partnership cited earlier operations involving Deadbolt, Genesis Market, and Qakbot.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcepolitie.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026
Ransomware activity surged in 2025 despite significant law enforcement actions against major ransomware-as-a-service (RaaS) groups, with new groups quickly filling the void and victim numbers reaching record highs. Data from RansomLook.io and Ransomware.live showed a sharp increase in claimed ransomware victims, with global numbers rising from approximately 5,400 in 2023 to over 8,000 in 2025. Attackers increasingly relied on social engineering rather than technical exploits, and the impact of ransomware was felt across all sectors, including retail, education, government, and healthcare. Notable incidents included coordinated campaigns against major UK retailers and disruptive attacks on organizations such as Coupang, University of Phoenix, and the NHS’s technology provider DXC Technology. The year’s most significant attacks demonstrated the systemic and cross-sector nature of modern cyber risk, with attackers exploiting third-party dependencies and identity weaknesses to maximize disruption. High-profile breaches led to operational outages, data exposure, and substantial financial and reputational damage, as seen in the case of Marks & Spencer, which suffered a dramatic drop in profits following a ransomware campaign attributed to the Scattered Spider group. These incidents have prompted organizations to reassess their incident response strategies, invest in ransomware readiness, and strengthen supply chain security as they prepare for evolving threats in 2026.
Jun 29, 2026
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026