The ransomware threat in numbers
Over the last year, ransomware has grown in sophistication and diversity


Ransomware continues to spread quickly and widely across the world, tightening its hold on the data and devices of both individuals and businesses.
Over the last year, ransomware has grown in sophistication and diversity. Kaspersky's Security Bulletin the evolution of ransomware, including key developments from the last 12 months, including the main trends and discoveries, as well as what measures are being taken to fight back against it.
A business is attacked by ransomware every 40 seconds
Attacks on businesses increased three-fold between January and the end of September, rising from an attack every two minutes to one every 40 seconds. For individuals, the rate of increase went from every 20 seconds to every 10 seconds. Overall, 23.9% of ransomware attacks are targeting corporates, up from 17% at the beginning of 2016.
.
A quarter of all users were attacked by CTB-Locker ransomware
Cerber and Locky arrived in the early spring; nasty, virulent strains of ransomware that are propagated widely through spam attachments and exploit kits. CryptXXX appeared a little later on, but established itself with the other two as a major player', targeting individuals and corporates. All three families continue to evolve alongside well-established incumbents such as CTB-Locker, CryptoWall and Shade.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
.
42% of small and medium-sized businesses were hit by ransomware last year
According to Kaspersky Lab research, in 2016, one in five businesses worldwide suffered an IT security incident as a result of a ransomware attack. As a result, small and medium-sized businesses are increasingly struggling with ransomware attacks, with 42% of them being hit by ransomware in the last 12 months. Of those affected, 32% paid the ransom, but one in five never got their files back, even after paying.
.
The number of new ransomware modifications has increased by eleven-fold
62 new ransomware families appeared in 2016, bringing with them a vast increase in the number of new ransomware modifications: 32,091 in Q3 from 2,900 in Q1, an increase of 11-fold. Locky ransomware, a new addition last spring, has so far been spread across 114 countries.
.
One in five IT and education businesses was affected by ransomware
Social engineering and human error remain key factors in corporate vulnerability. One in five cases involving significant data loss came about through employee carelessness or lack of awareness. Some industry sectors, including education and IT/telecoms are harder hit than others, but the research shows that all industries are at risk; there's no such thing as a low-risk sector any more.
Esther is a freelance media analyst, podcaster, and one-third of Media Voices. She has previously worked as a content marketing lead for Dennis Publishing and the Media Briefing. She writes frequently on topics such as subscriptions and tech developments for industry sites such as Digital Content Next and What’s New in Publishing. She is co-founder of the Publisher Podcast Awards and Publisher Podcast Summit; the first conference and awards dedicated to celebrating and elevating publisher podcasts.
-
AI coding tools are booming – and developers in this one country are by far the most frequent users
News AI coding tools are soaring in popularity worldwide, but developers in one particular country are among the most frequent users.
-
Cisco warns of critical flaw in Unified Communications Manager – so you better patch now
News While the bug doesn't appear to have been exploited in the wild, Cisco customers are advised to move fast to apply a patch
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operators
News A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attack
News A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?
News The Scattered Spider group has been highly active in recent years