RansomwareClock.org

Reported Cost of Ransomware Attacks 2025 YTD

Aggregated Estimate from Public and Private Sources, Reflects Reported Attacks Only. Actual cost estimated to be significantly higher.

The forecast for cybercrime in 2024 is harsh with attacks increasing in frequency, sophistication, and severity. We must work together to protect our companies and communities from the financial, operational, and emotional trauma of cyber-attacks.

Cyber Stats

$1.85m

average cost for remediation, business downtime, lost orders, operational costs, etc. 2X vs year ago. Recovery cost is 10X the size of the ransom payment. Sophos, The State of Ransomware 2021

93%

consider an organization's trustworthiness prior to purchasing. 59% would avoid doing business with a company cyberattacked in the past 12 months. Arcserve 2020 Survey

11 seconds

a new ransomware attack hits this year. Cybersecurity Ventures. (In the time it takes you to read this cyber stat, another business has been hit with a ransomware attack.)

207 days

days is the average time to identify a breach. Meaning the bad guys are in your system for over 6-months. IBM Security Cost of a Data Breach Report 2020.

Only 21%

of security professionals think their current security controls are adequate. Forrester State of Enterprise IoT Security in North America

21 days

days is the average downtime caused by a ransomware attack. Coveware Q4, 2020

Spotlight

CISA

The Cybersecurity and Infrastructure Security Agency (CISA) was founded in 2018 and is a standalone United States federal agency, organized under the Department of Homeland Security (DHS). It exists to...

RECENT ATTACKS & NEWS

November 13, 2026

FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’

Federal officials have yet to say what caused the communications disruption or whether they are investigating a possible cyberattack. The...

November 13, 2026

In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach

Noteworthy stories that might have slipped under the radar: Siemens details security advisory policy, OpenAI Codex backdoor risk, Microsoft warns...

November 13, 2026

Microsoft Struggles to Restore Email and Other Services in a Global Outage

Microsoft is trying different ways to identify the cause of the problem and get its servers back online, using “a...

November 13, 2026

Apify Confirms Customer Data Accessed in Cyberattack

The web scraping company says an intruder accessed customer accounts and obtained personal information or stored data. The post Apify...

November 13, 2026

SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks

Enea says SilentAir hijacked mobile network nodes to intercept calls and messages, with Taiwanese subscribers the primary targets. The post...

November 13, 2026

Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure

Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame. The post...

November 13, 2026

Citrix Patches 10 Critical NetScaler Vulnerabilities

Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions. The post Citrix Patches 10 Critical NetScaler Vulnerabilities appeared...

November 13, 2026

OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools

Daybreak Red Team pentests web applications with AI agents, while Defense Factory investigates security findings and prepares patches. The post...

November 13, 2026

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’

It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process. The post...

November 13, 2026

PHP2Shell Exploited in Destructive Check Point Gateway Attacks

PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root. The post PHP2Shell Exploited in Destructive Check...

PREVENTATIVE RESOURCES

Governmental and Law Enforcement

Legal Matters

Insurance Resources

In Case of Cyber Attack Emergency

If a ransomware incident occurs at your organization, CISA, FBI, and NSA recommend the following actions:

Follow the Ransomware Response Checklist on p. 11 of the CISA-Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide
Scan your backups. If possible, scan your backup data with an antivirus program to check that it is free of malware.
Report incidents immediately to CISA at https://us-cert.cisa.gov/report, a local FBI Field Office, or U.S. Secret Service Field Office
Apply incident response best practices found in the joint advisory from Australia, Canada, New Zealand, the United Kingdom, and the United States on Technical Approaches to Uncovering and Remediating Malicious Activity.

Contact your Local FBI Office - https://www.fbi.gov/contact-us/field-offices

Report a Complaint to the FBI’s Internet Criminal Complaint Center: www.IC3.gov

Technical Expertise/Crisis Communications

RansomwareClock.org

RansomwareClock.org

ALL RIGHTS RESERVED 2022

RansomwareClock.org

ALL RIGHTS RESERVED 2021