Ransomware attacks have reached new highs and lows, research from BlackFog shows.

While ransomware attacks have surged in numbers, the profitability of the popular cybersecurity threat is dwindling, according to BlackFog’s State of Ransomware Q1, 2025.

The cybersecurity firm found that March 2025 set a new record, with over 100 publicly disclosed attacks, a 8% rise compared to March of last year. This is also the largest number of attacks the company’s seen since it started tracking them in 2020.

March’s figures pushed the first quarter of 2025 to also reach a new high, with 278 publicly disclosed ransomware attacks.

Based on these numbers, BlackFog estimated that around 2124 unreported ransomware attacks happened during the first quarter of 2025, which would be a 113% year-on-year rise.

About 95% of disclosed ransomware attacks included a data leak, the report found, showing that data exfiltration is still a major priority of ransom groups.

The healthcare sector had the most ransomware attacks, BlackFog found, followed by government organisations, the education sector, and service providers.

The US was also the top targeted country according to the group.

In March specifically, 39 different ransomware groups were responsible for the attacks, with Qilin, Clop, and Akira leading the charge.

February also saw a marked increased in the number of ransomware attacks compared to last year, a rise of 35% to 77 total disclosed attacks.

Recommended reading

• ICO Confirms £3M Fine of Advanced Over 2022 Ransomware Attack
• Report: 41% of Ransomware Attacks Exploit Vendors
• Ransomware Top Predicted Cybersecurity Threat for 2025

Twenty-five different gangs were responsible for the attacks that month, with RansomHub taking responsibility for nearly 10% of all victims over the month.

Tracing back to January, the month saw 92 disclosed ransomware attacks, a 21% increase from last year. The month’s record-breaking figure was beat out by March’s stats, but still set an unprecedented pattern for the start of the year. 32 ransomware groups claimed responsibility for the attacks in January.

While 2025 started off with big numbers in terms of the amount of attacks, BlackFog found that the current average ransom demand is $663,582, which is dwarfed by the average ransom demand reported in July 2024 by Comparitech, which was $5.2m in the first half of 2024.

So, while ransomware attacks may be up, it may indicate that ransomware groups are forced to execute more attacks as payouts shrink.