2025 was a rollercoaster year for ransomware attacks, with multiple major incidents hitting UK businesses large and small. Given the ongoing frequency of ransomware attacks, this isn’t likely to slow down.  

So, how has ransomware changed over the last few years, and how can organisations prepare and respond? 

Ransomware in 2025  

The last few years have seen two major shifts in how ransomware attacks are carried out and defended against. Firstly, the behaviour of threat actors is changing: rather than simply stealing and encrypting data and then demanding money, attackers now resort to triple, and even quadruple extortion. 

Many will demand payment to stop data from being released, on top of decryption ransoms, and some will blackmail organisations with threats of reports to regulatory authorities or additional cyberattacks such as DDoS. Personal contact with victim organisation executives, as well as targeted harassment campaigns, are becoming more common. 

Secondly, there’s been a shift in how organisations see ransomware, and the recovery process has shifted from decryption, with data theft now a key concern for many organisations. In many cases, data theft is tantamount to destruction, since it means that the confidentiality and integrity of data is fundamentally broken. 

Ransomware has never solely been about recovery: it’s about preventing attacks, and the resilience of systems in the face of ongoing attacks. With these trends in mind, how can organisations start to prepare themselves? 

 Data Minimisation 

Many organisations host hoards of data online, much of which is often sensitive and needs to be kept private. On top of the data they choose to hold, some forms of data are legally required to be held, and in the case of organisations like universities, huge archives are kept which can stretch back decades or hundreds of years. 

With this in mind, when looking at your own data, there’s an important question to ask: does this need to be kept online? Does all data held online need to be readily and immediately accessible? 

Data which is readily accessible to you is data which is readily accessible to attackers. Data which can be accessed immediately after a system breach can be stolen, manipulated or destroyed. 

To stop this, there’s a simple solution: triage your data, understand what is actually needed for your organisation to function on a day to day basis, and keep the less essential data offline, either in cold storage, or in forms which make using and accessing it more difficult, namely through strong access control and encryption.  

Keeping encrypted backups of data is one of the most basic mitigations organisations should already be using, but really understanding how your live data is controlled and accessed is a simple way to ensure attackers will be unable to get at data. 

 Zero-Trust Principles 

Another angle to attack the problem is understanding who in your organisation can access sensitive data and why. For example: an attacker breaches an employee’s Microsoft account, and using OneDrive, their account can view projects and data being worked on by adjacent teams stored on the cloud, despite the employee not needing access to this data. 

Far too many systems are configured to allow an organisation’s members or employees more access than they realistically need to perform their work, and this increases an organisation’s attack-surface significantly. 

Recommended reading

• Report: Cyber Breaches Are Tanking Share Prices
• Inside the Aftermath: What Really Happens When You Get Hacked
• Report: 93% of Data Breaches Expose Financial Records

Following principles of zero-trust, especially around sensitive and critical data, is a fundamental way of mitigating ransomware attacks, and one which too few organisations follow today. By granting people only as much access to systems as they actually need to do their work, you reduce the amount of data attackers can access from any single breach, and you limit the potential for lateral movement inside systems. 

 Shifting to Resilience 

Reducing the exposure of your data, tightening how users can access and use data, and using technologies like MFA to force users to verify when they do need data all help to mitigate attacks, and prevent attackers from stealing data. All these measures help to shore up an organisation’s defenses, and they mean that if the worst-case scenario does occur, this can be controlled and mitigated. 

Following and implementing these principles reflects a resilience mindset, one that will be needed to tackle ransomware attacks as they continue to increase in frequency. Resilient systems make attacks harder and slower to perform, and in the long run, less damaging.