There was a 63% increase year-on-year in publicly disclosed cyber-attack volumes in Q2 2025, BlackFog found.

The second quarter of 2025 saw 276 incidents, the highest number of incidents in this timeframe – from April to June – since BlackFog began tracking in 2020.

All three months set a new high compared with the same time period in previous years.

June saw an 113% year-on-year increase with 96 attacks, with May seeing 91 attacks at a 40% increase, and April with a 51% increase and 89 attacks.

In terms of disclosed attacks, healthcare was the most targeted sector with 52 attacks. This was followed by the government sector, which recorded 45 attacks and the services industry with 33 attacks.

The retail sector, unsurprisingly, recorded its highest ever Q2 attack volumes, with UK retailers in particular bearing the brunt of high-profile ransomware attacks. The number of publicly disclosed ransomware incidents in this sector jumped by 58% compared to Q1 2025.

High-profile cases including the targeted cyber-attacks against M&S, Co-op, Harrods, and other retailers likely contributed to these high numbers.

The Construction, Hospitality, and Arts and Entertainment sectors also reported the highest ever Q2 attack volumes. Across the board, the use of data exfiltration remained consistently high, with 95% of publicly disclosed attacks involving the theft of sensitive information.

Amongst 53 active ransomware groups, the Qilin ransomware gang took the lead as the most active, responsible for 10% (28) of disclosed attacks and 15% of those revealed on dark web leak sites.

Earlier this year, CISA issued a formal warning after Qilin struck high profile targets in the UK and US and a group labelled a major risk to critical infrastructure.

Recommended

• Why Are Young People Becoming Cyber-criminals?
• Co-op Confirms Hack Hit All 6.5M Members
• Four Arrested in Investigation Into UK Retail Cyber-attacks

The figures also reveal that the scale of hidden activity remains significant with 80.9% of all ransomware attacks going unreported. Across Q2 there were 1,446 undisclosed ransomware attacks marking a 19% increase compared to the same quarter in 2024.

As with the first quarter of this year, the services industry was the hardest hit, accounting for 23% (337) of all undisclosed attacks in Q2.

“The findings lay bare the extent of the challenge that organisations face,” Dr. Darren Williams, founder and CEO of BlackFog said.

“The past few months have been especially punishing for global retailers, with prominent high street stores falling victim and absorbing the financial and operational fallout of these attacks.

“The findings also highlight that, time and again, attackers are ultimately after one thing: data. This is yet another reminder that organisations must take decisive action to reduce the risk of exfiltration with controls and processes that form a protective ‘ring of steel’ around their most sensitive data to stop attackers in their tracks.”