State of Ransomware 2025: Exfiltration Rates, Top Targets and What the Data Tells Us

Attack Volume and Trends

BlackFog tracked a 48% increase in publicly reported ransomware attacks in 2024 compared to 2023. The true figure is significantly higher — research consistently suggests that only 1 in 10 ransomware incidents is publicly disclosed. The monthly cadence showed sustained elevated activity throughout 2024, with no seasonal lull. Law enforcement disruptions — including the FBI's takedown of LockBit infrastructure in February 2024 and ALPHV/BlackCat's exit scam in March 2024 — created temporary reductions that were quickly filled by emerging groups including RansomHub, Akira, and Play.

Data Exfiltration: The Dominant Attack Model

The 93% exfiltration rate represents the most significant shift in ransomware strategy. In 2020, fewer than 40% of ransomware attacks included data exfiltration. The progression — 40% in 2020, 57% in 2021, 70% in 2022, 86% in 2023, 93% in 2024 — demonstrates a near-complete industry pivot from encryption-only to exfiltration-first operations. Several prominent groups including BianLian and Karakurt have abandoned encryption entirely, operating as pure data extortion outfits. The message is unambiguous: if your ransomware defence strategy is built around backups and recovery, you are defending against a model that no longer represents the primary threat.

Most Targeted Sectors

Healthcare remains the most heavily targeted sector, accounting for 24% of all ransomware incidents. Education follows at 18%, with government at 15%. The concentration in these sectors reflects attacker economics — they hold sensitive data that creates maximum extortion pressure, they are often under-resourced in cybersecurity, and they face intense regulatory and public scrutiny that increases willingness to pay:

• Healthcare (24%): patient records, medical histories, and insurance data create life-safety pressure — the Ascension Health attack in May 2024 forced ambulance diversions
• Education (18%): student data, research intellectual property, and minimal security budgets — the University of Manchester breach exposed data on 1.1 million NHS patients held for research
• Government (15%): citizen data, critical infrastructure access, and political pressure to restore services — the City of Dallas was crippled for weeks in 2023
• Manufacturing (12%): operational technology disruption and supply chain leverage — attacks on manufacturers increased 56% year-over-year
• Financial services (10%): direct financial data and regulatory pressure — though better-resourced defences keep the percentage lower
• Technology (8%): source code, customer data, and supply chain access — tech companies are both targets and vectors

The Ransomware-as-a-Service Ecosystem

The ransomware landscape is dominated by the Ransomware-as-a-Service (RaaS) model, where core groups develop the malware and infrastructure while affiliates carry out attacks in exchange for a revenue share — typically 70-80% of ransom payments. LockBit dominated through early 2024 before law enforcement disruption. RansomHub rapidly emerged to fill the vacuum, attracting former LockBit and ALPHV affiliates with an 90/10 split favouring affiliates. This franchise model means that disrupting any single group is insufficient — affiliates simply migrate to the next platform. The barrier to entry for conducting sophisticated ransomware attacks has never been lower.

What This Means for Your Defence Strategy

The data from BlackFog's report leads to clear strategic conclusions for security leaders. Backup-centric ransomware strategies are necessary but insufficient — they address only the 7% of attacks that rely solely on encryption. Exfiltration prevention must be a primary control, not an afterthought. Detection-based approaches face a timing problem — by the time ransomware is detected, exfiltration has typically already occurred. Prevention at the device level, before data leaves the endpoint, is the only reliable way to neutralise the exfiltration threat that defines 93% of modern ransomware attacks.

Frequently Asked Questions