The IT Nerd

Comparitech researchers has published a research study diving into this very ransomware gang.

Key findings for Qilin in 2025 include:

• 701 victims (118 of these attacks have been confirmed)
• 45 attacks on healthcare providers (14 confirmed)
• 40 attacks on government entities (22 confirmed)
• 26 attacks on the education sector (7 confirmed)
• 590 attacks on businesses (75 confirmed):
  • 143 on manufacturers (11 confirmed)
  • 108 on service-based businesses (9 confirmed)
  • 69 on finance companies (27 confirmed)
  • 50 on retailers (2 confirmed)
  • 34 on construction companies (2 confirmed)
• 788,377 records breached in the confirmed attacks
• 116 TB of data stolen across all attacks (47 TB in confirmed attacks)
• The US accounts for the most attacks (375), followed by France (41), Canada (39), South Korea (33), and Spain (26)

You can read more here: https://www.comparitech.com/news/qilin-ransomware-stats-on-attacks-ransoms-data-breaches/

This morning, Comparitech researchers published an in-depth look at the impact of government ransomware attacks globally for the period of Q1-Q3 2025. 

According to the study, during the first nine months of this year, there was a total of 276 attacks on government organizations, which was a 41 percent increase from the same period in 2024 (196).

This study dives into all things government ransomware attacks — including the average ransomware demand across these attacks, which ransomware gangs were the most prolific in this sector, which countries were most impacted, as well as which attacks were the largest in this period. 

Key Finding Include:

• 276 attacks in total
• 147 confirmed attacks
• 129 unconfirmed attacks
• 443,522 records are known to have been breached in the confirmed attacks
• Average ransom demand across all attacks = $1.95 million
• The US has seen an 8% increase in attacks (when compared to the same period of 2024)
• The ransomware strains that claimed the most attacks against government agencies were Qilin (31), Babuk (26), INC (25), SafePay (13), Funksec (12), RansomHub (12), and Medusa (10)
• Qilin took credit for the most confirmed attacks (19), followed by INC (12), RansomHub (8), and SafePay (6), and Medusa (6)

For full details, the study can be read here.

Comparitech researchers have published a study looking at all things healthcare ransomware attacks for the first nine months of 2025. 

According to the study, 293 ransomware attacks occured in this time frame against hospitals, clinics, and other direct care providers. There was a further 130 attacks on businesses operating within the healthcare sector, such as pharma, billing, etc. 

Attacks on healthcare providers saw similar numbers in the same period last year, but attacks on healthcare businesses rose by 30 percent. 

You can read the report here: https://www.comparitech.com/news/healthcare-ransomware-roundup-q1-q3-2025-stats-on-attacks-ransoms-and-data-breaches/

Today, Comparitech researchers published a ransomware roundup for the third quarter of 2025. So far this year, there have been a total of 5,186 tracked ransomware attacks. This is a 36% increase from the same period of time in 2024. 

Q3 of 2025 also saw a 6 percent increase in attacks from Q2 of 2025—rising from 1,434 to 1,517. 

The study takes a look at the most prolific ransomware strains, as well as at ransomware attacks by sector, finding that year over year, attacks on government and healthcare organizations have decreased, while attacks against the education sector remained similar. 

The full study can be found here at this link: https://www.comparitech.com/news/ransomware-roundup-q3-2025/

Comparitech today reported that auto dealership software company Motility Software Solutions this week notified 766,670 people of an August 2025 data breach that compromised names, SSNs, phone numbers, email addresses, DOBs, and driver’s license numbers. 

Rebecca Moody, Head of Data Research at Comparitech, provided the following commentary:

“This ransomware attack becomes the ninth largest this year so far (based on records affected) and is the second-largest breach on a technology company.

It’s also yet another attack on a software company that’s used by multiple organizations. In recent months, we’ve seen a number of disruptive attacks like these which have had far-reaching consequences either in the large quantities of data breached and/or the disruption of encrypted systems. Other examples include the attack on Collins Aerospace which caused chaos across European airports and the attack on a Swedish technology company, Miljödata, which impacted over 200 municipalities with system downtime and has seen a breach of at least 1 million records.

As hackers continue to evolve and look for the most disruptive ways to have an impact, attacks on companies like Motility Software Solutions offer great appeal because of how many entities can be targeted through one company. While this attack on Motility Software Solutions doesn’t appear to have caused a lot of disruption to car dealers (like the attack on CDK did back in June 2024), it has resulted in a significant data breach.”

Victims of this breach should be prepared for secondary attacks as you know those will be inbound. Thus it highlights the fact that organizations should make every effort to keep the bad guys out at all costs.

Today, Comparitech researchers released a study looking at the state of global ransomware attacks in August 2025. 

Ransomware attacks continued to climb again in August, rising from 473 in July to 506 last month. August also saw a first-of-a-kind attack on the State of Nevada. While hundreds of US government organizations have suffered ransomware attacks, this is the first-ever statewide attack.

Rebecca Moody, Head of Data Research at Comparitech, commented:

“If we needed a reminder of how dominant a threat ransomware is, August’s statistics provide it. Not only did we see a steady increase in attacks but we also witnessed a first-of-its-kind attack on the State of Nevada. The latter in particular highlights how no one, not even a multi-billion-dollar government organization, is immune to these types of attacks. And, even though numerous countries and governments are looking to ban public entities from making ransom payments, this is doing little to deter hackers.”

“Why? It’s likely due to a number of reasons. Firstly, these attacks are often random, e.g. because the hackers start exploiting a known vulnerability or a staff member happens to click on or download something they shouldn’t. Second, even if the hackers don’t receive the ransom, they’re most certainly going to gain notoriety when they make their claim on the State of Nevada. So, when another entity finds itself facing an attack from the same organization, they’ll instantly recognize the group’s name and may be more inclined to pay up before the attack escalates any further. Finally, it’s more than likely that the hackers will have stolen data in this attack on Nevada, so they’ll always have this to sell on the dark web if needed.”

“While banning public entities from making ransom payments may be a step toward reducing ransomware attacks, it isn’t the silver bullet. Rather, it should be part of a multi-pronged approach and one that makes sure the basics are covered. This includes patching any vulnerabilities as soon as they are flagged, making sure systems are regularly updated, carrying out frequent backups, investing in employee training, and having a step-by-step plan in place should an attack occur.”

For full details, the August ransomware roundup can be found here: https://www.comparitech.com/news/ransomware-roundup-august-2025/

Earlier this year, the Tech Transparency Project published a report stating that more than 20 out of the top 100 free VPNs on US app stores showed evidence of Chinese ownership. 

After TTP published its report, Apple removed some of the allegedly Chinese-owned apps from the App Store, but others remained. To further investigate the remaining VPN apps’ ties to China and Russia, Comparitech researchers decompiled the app APKs and checked for network fingerprints.

In total, Comparitech analyzed 24 VPN apps provided on iOS and Android. You can find more details on what was found here: https://www.comparitech.com/news/a-deeper-dive-into-the-china-and-russia-linked-vpns-on-ios-and-android/

Comparitech researchers have released a study looking at the privacy risks of religious apps. The findings are shocking — more than half of the apps offered by Google Play may be violating Google’s privacy policies. 

Key findings include: 

• The average religious app requests access to 21 permissions in total, 3.7 of which are classed as high-level/”dangerous”
• The most common dangerous permissions are ones that request access to read and write external storage (data outside of the app, eg, stored on the device), access location data (precise geolocation data or approximate location based on cell tower or Wi-Fi data), read the phone state (access to current cellular network information, the status of any ongoing calls, and a list of any phone accounts registered on the device), and request access to record audio and/or use the camera function
• 46% of apps (73 apps out of 158) potentially violate Google’s privacy policy standards
• The most common omission from privacy policies was the data retention period (not provided by 56 apps), followed by a clear policy on how users can delete their data (omitted by 48 apps)
• These apps have been downloaded 500 million times

You can find the study here: https://www.comparitech.com/news/religious-apps-study/

Ransomware group Interlock today took credit for a July cyber attack on the city of St. Paul, Minnesota. The attack prompted governor Tim Walz to activate the national guard in response. And to top that off, the city didn’t pay up.

Commenting on this news is Rebecca Moody, Head of Data Research at Comparitech: 

“While the City of St. Paul should be applauded for not meeting its hackers’ ransom demands, it was inevitable that a claim from the responsible group would quickly appear. Interlock wasted no time posting the city to its site and alleges that 43 GB has been stolen. This is made up of 66,460 files across nearly 7,900 folders with the proof pack containing various IDs and documents.”

“Now, the City of St. Paul needs to respond to confirm what data has potentially been impacted and who has been affected. In the meantime, we highly recommend residents and employees remain on high alert for any potential phishing campaigns (e.g. emails, texts, or calls reporting to be from St. Paul) and monitor their accounts for any suspicious activity.”

“As our report for July 2025 has found, ransomware attacks on government entities are of particular concern as hackers remain focused on causing mass disruption via these organizations, with critical infrastructure also being targeted. St. Paul is a prime example of this as numerous areas have been affected, including public works and payments for water services.”

I am a big believer that you should not pay these threat actors as it only encourages them to keep doing this. The new problem is that the data that Interlock stole is now out there. And that will have far reaching effects on those people who are associated with that data.

Today, Comparitech researchers released a study looking at the state of global ransomware attacks in July 2025. It was found that after three consecutive months of decline, July saw a four-percent uptick in ransomware attacks. Additionally, governments remain a key focus for hackers, with nine confirmed attacks on this sector carried out in nine different countries. 

Key findings include: 

• 464 attacks in total — 35 confirmed attacks
• Of the 35 confirmed attacks:
  • 18 were on businesses
  • 9 were on government entities
  • 3 was on healthcare companies
  • 5 were on educational institutions
• Of the 429 unconfirmed attacks:
  • 383 were on businesses
  • 12 were on government entities
  • 21 were on healthcare companies
  • 12 were on educational institutions
• The most prolific ransomware gangs were Qilin (62), INC (55), SafePay (43), Akira (37), and Play (22). INC had the most confirmed attacks (5), followed by Qilin (4), SafePay (3), and Rhysida (2)
• Where hackers provided the data theft size (in 222 cases), nearly 105 TB of data was allegedly stolen, giving an average of 476 GB per breach
• Several new gangs appeared this month, including Payouts King, Beast, and D4RK 4RMY. BlackByte also resurfaced after a 10-month hiatus

For full details, the full research can be found here: https://www.comparitech.com/news/ransomware-roundup-july-2025/