Loading story…
A recent report by insurance specialist Hiscox reveals that ransomware attacks continue to pose a significant threat to businesses, with 27% of 5,750 surveyed small and medium-sized enterprises (SMEs) targeted by ransomware in the past year. Of those affected, 80% paid the ransom, yet only 60% managed to recover all or part of their data, highlighting the unreliable nature of ransom payments as a recovery strategy. The report also notes that nearly a third of companies that paid were subsequently met with additional demands for more money, compounding the financial and operational risks. The impact of these attacks is severe, with some high-profile companies such as Marks and Spencer, the Co-op, and Jaguar Land Rover (JLR) experiencing significant disruptions. JLR, for example, received a £1.5bn government loan guarantee to protect its supply chain after a month-long factory shutdown. Many SMEs, lacking such support, face existential threats from ransomware incidents, with some already forced to lay off staff. The study also points to vulnerabilities introduced by artificial intelligence as a contributing factor to the rise in successful cyber attacks. In parallel, ransomware gangs are evolving their tactics, as illustrated by the Medusa ransomware group's attempt to recruit a BBC journalist as an insider. The gang offered the journalist a substantial share of any ransom paid if he provided access to the BBC's internal systems, with the promise of anonymity and references to previous successful insider-assisted attacks. Medusa, active since 2021, is known for double-extortion tactics and has been linked to over 300 attacks on critical infrastructure in the United States, according to CISA. The group typically recruits initial access brokers via cybercrime forums and darknet marketplaces, focusing on leveraging insider threats and post-compromise extortion. The incident involving the BBC journalist underscores the increasing sophistication of ransomware groups in targeting not just technical vulnerabilities but also human factors within organizations. These developments highlight the urgent need for organizations to strengthen both their technical defenses and insider threat detection capabilities. The financial and reputational risks associated with ransomware are escalating, with attackers employing a mix of extortion, social engineering, and exploitation of emerging technologies. The Hiscox report and the Medusa case collectively demonstrate that paying ransoms does not guarantee data recovery and may even invite further extortion. Organizations are advised to invest in comprehensive cybersecurity measures, employee awareness training, and robust incident response plans to mitigate the growing threat landscape. The trend of targeting SMEs, which often lack the resources of larger enterprises, suggests that all organizations, regardless of size, are at risk. The evolving tactics of ransomware groups, including the recruitment of insiders, represent a significant challenge for security teams and require a multi-layered approach to defense.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Initial story creation
Semperis’s 2024 Ransomware Risk Report, based on a survey of 900 IT and security executives in France, Germany, the U.K., and the U.S., found that 32% of attacked organizations paid ransomware demands four or more times in the prior 12 months. The report also said most victims faced repeated attacks, widespread operational disruption, and frequent compromise of identity systems such as Active Directory and Entra ID.
4 references tracked. Mallory keeps watching after this page renders.
thetimes.com
Open sourcenews.sky.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritydive.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware attacks continue to pose a significant threat to organizations, with recent surveys indicating that paying the ransom does not guarantee successful data recovery. According to Hiscox’s Cyber Readiness Report, only 60% of companies that paid a ransom were able to recover all or part of their data, while 40% lost their data despite payment. The technical sophistication of ransomware operators varies, with established groups more likely to provide functional decryptors, but many victims still face flawed encryption or unresponsive attackers. Additionally, the frequency of ransomware incidents has surged, with reports showing a near tripling of cases year-over-year in early 2025, and a majority of victims experiencing data theft even after paying ransoms. The ransomware landscape has evolved from high-volume, opportunistic attacks to a "big game hunting" model, where adversaries selectively target organizations with the most to lose and the greatest ability to pay. New criminal syndicates such as Spoiled Scorpius (RansomHub) and Howling Scorpius (Akira) are conducting sophisticated, long-term campaigns against high-value targets, often employing multi-extortion tactics that combine data encryption with threats of public exposure. This strategic shift has transformed ransomware from a purely IT issue into a critical business continuity threat, requiring organizations to adopt new defensive strategies and prepare for more calculated, high-impact attacks.
Jun 29, 2026
Ransomware attacks have reached unprecedented levels globally, with the third quarter of 2025 witnessing a 36% year-over-year increase in publicly disclosed incidents, according to BlackFog’s latest report. The total number of ransomware attacks reported in this period climbed to 270, marking a 335% rise since Q3 2020. These attacks have caused significant operational disruptions across various sectors, including airlines, automotive manufacturers, governments, and organizations in 93 countries. Notable incidents include grounded aircraft, stranded passengers, and manufacturers such as Jaguar Land Rover being forced to halt production, with some operations only recently resuming after prolonged outages. The impact of ransomware extends beyond large enterprises, severely affecting small businesses that often lack the resources and security infrastructure to defend against such threats. Many small business owners have reported devastating financial consequences, with some losing nearly all their savings and seeing their businesses shrink dramatically. The attack on the UK nursery chain Kido in September 2025 highlighted the evolving tactics of ransomware groups, as sensitive data on children, parents, and carers was exfiltrated, raising concerns about the targeting of vulnerable sectors. Ransomware operators are increasingly indiscriminate, targeting organizations of all sizes and types, and seeking leverage through data theft and extortion. The psychological and financial toll on victims is profound, with individuals and organizations facing long-term recovery challenges. Research indicates that small businesses are particularly vulnerable, often lacking dedicated IT security staff, legal support, or sufficient cash reserves to weather the aftermath of an attack. The stress and adversity experienced by victims underscore the need for robust data protection and incident response strategies. Experts emphasize that the best defense is to make it as difficult as possible for cybercriminals to succeed, focusing on data protection to reduce the incentive for extortion. The continued upward trend in ransomware volumes signals an urgent need for organizations to reassess their security postures and invest in preventive measures. The widespread and lasting impact of these attacks demonstrates that ransomware remains one of the most significant threats to global business continuity and data security. Organizations are urged to prioritize anti-data exfiltration technologies and comprehensive incident response planning. The evolving threat landscape requires constant vigilance and adaptation to new attacker tactics. The experiences of both large enterprises and small businesses illustrate the far-reaching consequences of ransomware, from operational shutdowns to personal financial ruin. As attackers become more aggressive and sophisticated, the imperative for proactive defense and resilience has never been greater.
Jun 29, 2026
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026