RESEARCH
Global Ransomware Attacks Hit a Record in 2025 -- but Growth-Rate Estimates Span 32% to 58%
Five independent trackers -- Comparitech, Breachsense, NCC Group, Chainalysis (citing eCrime.ch), and GuidePoint Security's GRIT team -- each published year-over-year growth figures for global ransomware attack and victim volume in 2025. All five agree 2025 set a record and all report double-digit growth, but the reported rate itself ranges from 32% to 58% depending on which leak-site dataset and counting methodology the firm used. A claim like 'ransomware attacks grew at least 50% in 2025' is true according to three trackers and false according to two.
Findings
- Comparitech recorded 7,419 global ransomware attacks in 2025, up 32% from 5,631 in 2024 -- the lowest growth estimate among the five trackers.
- Breachsense counted 7,307 victims listed on leak sites in 2025 across 138 active groups, a 45% increase over 2024's 5,028 victims.
- NCC Group and Chainalysis (citing eCrime.ch data) independently converged on the same 50% year-over-year figure, while GuidePoint Security's GRIT team reported the highest estimate: 7,515 claimed victims, up 58% -- its most active year on record.
- All five trackers count 'claimed' victims from ransomware groups' own dark-web leak sites rather than confirmed, organization-acknowledged breaches -- the same underlying data-collection method producing growth estimates that differ by 26 percentage points.
Delta Engine result
↔ Divergence Detected — Δ 0.3515 (threshold 0.05)
- GuidePoint Security T0 97
- Comparitech T0 90
- NCC Group T0 88
- Breachsense T0 85
- Chainalysis T0 68
Evidence quality
avg 25 · min 25 · max 25 · spread 0