State of Ransomware: July 2025
Published 1 August 2025 · ThreatVectr Intelligence
Ransomware groups claimed 500 attacks on organisations worldwide in July 2025. 58 distinct groups posted at least one victim during the month, across 61 countries. The busiest single day was 15 July, with 36 victims listed.
Qilin was the most active operation of the month, claiming 55 victims — 11% of all listings. Akira (45) and INC Ransom (43) followed.
Business Services bore the heaviest targeting, with 85 claimed victims, ahead of Manufacturing (70) and Technology (64). By geography, United States accounted for 242 claims — 48% of the month — with Italy (17) and France (16) next.
Claims per day — July 2025
Most active groups
- 1Qilin·5511%
- 2Akira·459%
- 3INC Ransom·439%
- 4DragonForce·235%
- 5Play·214%
- 6Everest·194%
- 7Lynx·184%
- 8Worldleaks·173%
- 9Global·143%
- 10SafePay·143%
Most-targeted sectors
- 1Business Services85
- 2Manufacturing70
- 3Technology64
- 4Construction36
- 5Healthcare32
- 6Consumer Services31
- 7Financial Services26
- 8Education20
- 9Agriculture and Food Production19
- 10Public Sector17
Most-affected countries
- 1United States242
- 2Italy17
- 3France16
- 4Canada15
- 5United Kingdom15
- 6Germany14
- 7Brazil11
- 8Japan9
- 9Spain8
- 10Sweden7
Every figure in this report counts a claim posted to a criminal leak site, observed via the monitoring service ransomware.live. A listing is an extortion tactic, not a confirmed breach: some claims are exaggerated, some are duplicates under new branding, and a few are outright false. Companies named in listings have not necessarily confirmed any incident, and ThreatVectr does not publish victim names from this dataset.
Cite this report
This report is free to cite and reproduce with attribution. Suggested citation:
ThreatVectr, “State of Ransomware: July 2025”, https://threatvectr.com/ransomware-tracker/reports/july-2025
Journalists and researchers: for questions about the data or methodology, contact the newsdesk.
Most ransomware starts with one email
The groups in this report overwhelmingly get in through phishing. Train2Secure runs realistic phishing simulations and short training that teach your team to spot the lure.