Comparitech has released its monthly ransomware roundup for November 2025. The research examines ransomware trends in 2024 and 2025, including both confirmed and unconfirmed attacks by month. It explores the number of attacks across key sectors, including business, healthcare, government, and education, and compares these figures to October’s findings.
Additionally, the research looks at ransomware claims by industry, comparing October to November 2025, identifies the most prolific ransomware strains, and analyses attacks by ransomware group and by country in November. A brief sector-specific analysis of the attacks is also included. The research found that Qilin continued to hold the top spot for the number of claims (107), though Akira (100) and Clop (94) closed in on its lead throughout November.
Key findings include:
- 659 attacks in total — 38 confirmed attacks (confirmed by the entity involved)
- Of the 38 confirmed attacks:
- 22 were on businesses
- 10 were on government entities
- 2 were on healthcare companies
- 4 were on educational institutions
- Of the 621 unconfirmed attacks*:
- 544 were on businesses
- 18 were on government entities
- 30 were on healthcare companies
- 17 were on educational institutions
- The most prolific ransomware gangs were Qilin (107), Akira (100), and Clop (94)
- Qilin had the most confirmed attacks (5), followed by INC (3) and Akira, Clop, Everest, and Beast (2 each)
- Where hackers provided the data theft size (in 276 cases), over 31,200 TB of data was allegedly stolen. This huge figure stems primarily from Qilin’s claim on a US manufacturer where it alleged to have stolen “31,063,838.00 GB”.
- The US saw the most attacks (354), followed by Canada (34), the UK (17), and Germany and India (14 each)
*12 attacks were on unknown companies that couldn’t be attributed to a specific sector.
Here is a link to the research: https://www.comparitech.com/news/ransomware-roundup-november-2025/
Related
This entry was posted on December 2, 2025 at 11:43 am and is filed under Commentary with tags Comparitech. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Qilin Remains Top Ransomware Group in November as Akira and Clop Close In
Comparitech has released its monthly ransomware roundup for November 2025. The research examines ransomware trends in 2024 and 2025, including both confirmed and unconfirmed attacks by month. It explores the number of attacks across key sectors, including business, healthcare, government, and education, and compares these figures to October’s findings.
Additionally, the research looks at ransomware claims by industry, comparing October to November 2025, identifies the most prolific ransomware strains, and analyses attacks by ransomware group and by country in November. A brief sector-specific analysis of the attacks is also included. The research found that Qilin continued to hold the top spot for the number of claims (107), though Akira (100) and Clop (94) closed in on its lead throughout November.
Key findings include:
*12 attacks were on unknown companies that couldn’t be attributed to a specific sector.
Here is a link to the research: https://www.comparitech.com/news/ransomware-roundup-november-2025/
Share this:
Like this:
Related
This entry was posted on December 2, 2025 at 11:43 am and is filed under Commentary with tags Comparitech. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.