Ransomware in 2025: Organisations at Risk & Making Headlines

Cyber Attacks in 2025: Frequently Asked Questions

What is ransomware?

Ransomware is a type of malicious software that encrypts data on a victim’s system, rendering it inaccessible until a ransom is paid to the attacker. In recent years, attackers have also adopted tactics such as data theft and extortion, even if files are not encrypted.

Are ransomware attacks still common?

Yes, ransomware attacks continue to pose a substantial risk. Cyber attacks are popping up frequently in headlines, with M&S, Transport for London, Jaguar Land Rover, and European Airports cyber attacks all making the headlines this year.

However, it’s not all doom and gloom. There are positive trends, including a reduction in successful data encryption during attacks and a decrease in ransom demands and payments compared to previous years.

Who is most at risk from ransomware attacks?

Unfortunately, no organisation is safe from cyber crime. Larger organisations remain the primary targets for both data encryption and data theft, as they often have the budgets to pay ransoms.

However, smaller organisations are still appealing to cyber criminals as they often have weaker cyber defences and can be lucrative for cyber criminals at scale.

What is driving cyber attacks in 2025?

Despite growing awareness, exploited vulnerabilities remain the top technical root cause of ransomware attacks for the third year running (32%).

But the real story lies in operational weaknesses:

Lack of expertise (40.2%)

Many organisations do not have the necessary expertise or staff to identify, prevent, or respond to cyber threats efficiently. This lack of resources makes them vulnerable to data breaches and cyber attacks, which can result in significant financial losses, reputational damage, and disruption to business operations.

Unknown security gaps (40.1%)

Undetected or unaddressed weaknesses in an organisation’s cyber defences.
Organisations looking to remedy this should consider mapping their attack surface and conducting a cyber posture review.

Insufficient capacity (39.4%)

This can manifest as too few cyber security professionals, outdated or incomplete security tools, or gaps in incident response planning. As a result, organisations with insufficient capacity are more vulnerable to cyber attacks, as they may struggle to identify and address threats swiftly or comprehensively.

Building greater capacity often involves investing in staff training, upgrading technology, and developing robust cyber defence strategies to enhance overall resilience against ransomware threats.