A new study shows hackers are relentless and ransomware is still a global epidemic: in 40% of attacks, threat actors threatened to physically harm executives at organisations that declined to pay a ransom demand.
The 2025 Ransomware Risk Report from Semperis found that UK organisations are being targeted more than most other countries (84%), and around half of those attacks (49%) are successful.
While data erasure and release of sensitive data are the most common threats, 47% of attacked companies in the US, UK, France, Germany, Spain, Italy, Singapore, Canada, Australia and New Zealand also reported that hackers threatened to file regulatory complaints against them if they didn’t report the incident.
In comparing results from last year’s ransomware study, Semperis found slight decreases year over year in companies paying ransoms. Still, 69% of companies that were victimised by ransomware paid a ransom (a drop of 10 percentage points). However, UK government and public sector organisations are alarmingly more likely to pay: An overwhelming 83% paid the ransom, ahead of the planned ransomware payment ban. Globally, 38% of companies paid multiple ransoms and 11% of companies paid three times or more.
Former US National Cyber Director and Semperis Strategic Advisor Chris Inglis suggests that now is not the time for companies to get a false sense of security. He said: “Now is not the time for complacency. True regret isn’t knowing what you should have done; it’s not having done what you knew was needed and had the means to do.”
Ransomware attacks continue to be highly coordinated, strategically timed and deeply embedded throughout systems before they are executed. This gives multiple attackers access to multiple operational systems — so they can execute multiple strikes. Organisations must be on continual alert, always ready for the success of not one, but multiple breaches.
The findings indicate that ransomware attacks are frequent, with 50% of respondents citing cybersecurity threats as the top threat to business resilience. The top cybersecurity challenge facing organisations is the sophistication of attacks (37%), while for 32% it is attacks against organisations’ identity infrastructure, most commonly Active Directory. Nearly 20% of companies that paid a ransom either received corrupt decryption keys that were unusable or the hackers still published stolen data after stating they would not.
“Paying ransoms should never be the default option. While some circumstances might leave the company in a non-choice situation, we should acknowledge that it’s a downpayment on the next attack. Every dollar handed to ransomware gangs fuels their criminal economy, incentivising them to strike again. The only real way to break the ransomware scourge is to invest in resilience, creating an option to not pay ransom,” said Mickey Bresman, CEO of Semperis.
First, organisations should evaluate the security of partners and supply chain vendors as they could be the weakest link. When partners and vendors have access to sensitive systems and data, risk increases. Organisations should also be prepared for changing tactics in ransomware development and deployment, and plan regular tabletop exercises to improve ransomware response.
Jen Easterly, the former Director of the Cybersecurity and Infrastructure Agency (CISA) believes there are signs of defenders increasingly winning battles in the ransomware fight with criminal enterprises. “I believe that we can make ransomware a shocking anomaly. And that is the world I want to live in: A world where software vulnerabilities are so rare that they make the nightly news, not the morning meeting. A world where cyberattacks are as infrequent as plane collisions. I do believe we can get there.”
The full ransomware study can be obtained here: 2025 Ransomware Risk Report: Essential Guidance for Building Operational Resilience Against Cyberattacks.
Photo by SCARECROW artworks on Unsplash
