Ransomware attacks rose 28% globally in September 2025, targeting industries and major infrastructure, with payment rates and averages falling sharply.

Ransomware attacks surged 28% globally in September 2025, reaching 421 incidents, with the Industrials sector most targeted. North America and Europe accounted for 75% of attacks, including a major disruption at European airports. The cyber group Qilin was the most active, responsible for 14% of September’s incidents. Ransom payment rates hit a record low of 23% in Q3, as attackers shifted from broad campaigns to targeted, high-effort attacks on large enterprises, using social engineering and insider bribes. Average ransom payments dropped 66% to $376,941. New threat groups and geopolitical tensions are fueling a more complex, fragmented threat landscape.