The IT Nerd

Comparitech researchers have released a study looking at all the government ransomware attacks of the first half of 2025. Government organizations are a dominant focus for hackers, due to the sensitive information the industry holds.

According to the findings, there was a 65% increase in attacks compared to the first half of 2024.

This research looks at ransomware attacks on government organizations by country, finding the U.S. to have been the most targeted. Additionally, the study outlines the biggest ransomware demands on governments, worldwide, as well as which gangs are most prolific in this industry. 

Key findings include: 

• 208 attacks in total – 124 in Q1 and 84 in Q2
• 104 confirmed attacks – 54 in Q1 and 50 in Q2
• 104 unconfirmed attacks – 70 in Q1 and 34 in Q2
• 366,006 records are known to have been breached in the confirmed attacks
• 78.5 TB of data allegedly stolen (67.2 TB in the confirmed attacks)
• Average theft of 1.3 TB of data per attack
• Average ransom demand of $1.65 million
• The most prolific ransomware strains with the highest number of claims against government entities were Babuk (26), Qilin (17), INC (16), Funksec (12), and RansomHub (12)
• Qilin had the most confirmed attacks (13), followed by INC and RansomHub (8 each)

You can read the research here: https://www.comparitech.com/news/government-ransomware-roundup-h1-2025-stats-on-attacks-ransoms-and-data-breaches/

Prestige Maintenance USA this week confirmed that it had notified 65,452 people of a January 2025 data breach that compromised their personal information. Ransomware group Medusa took credit for the breach shortly after it occurred and demanded $1.2 million in ransom. This may not be the first time that they have been pwned as there is an unconfirmed report of ALPHV/BlackCat pwning them in 2023.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“Medusa is a ransomware gang that first surfaced in September 2019. It debuted its leak site in February 2023, where it publishes stolen data of victims who don’t pay ransoms. Medusa often uses a double-extortion approach in which victims are forced to pay both to decrypt their systems and for not selling or publishing stolen data. Medusa has claimed responsibility for 132 confirmed attacks in total, compromising more than 3.1 million records. Its average ransom demand is $631,000.”

“In 2025, Comparitech researchers have logged 226 confirmed ransomware attacks on US organizations in total, plus 1,788 unconfirmed claims. Ransomware attacks on US organizations can both steal data and lock down computer systems. Infected businesses are forced to either pay a ransom or face extended downtime, permanent data loss, and putting customers at increased risk of fraud.”

The fact that the company didn’t tell anyone about this this until seven months later is troubling. And the fact that they might have been pwned before suggests that this is an organization that isn’t great at keeping the bad guys out. I say that someone needs to ask this company some really tough questions and the company needs to answer them if they want anyone to trust them.

Comparitech researchers have released a study looking at the impact of healthcare ransomware in H1 2025, finding a decline in attacks compared to H1 2024. 

While the healthcare sector hasn’t seen the same influx in attacks as other industries (a recent 2025 H1 report saw a 50 percent increase across the board from 2024), this could be due to several factors.

Ransomware attacks on healthcare companies continue to have devastating consequences. This became only too evident recently when a patient’s death was linked to the June 2024 attack on Synnovis in the UK.

Key findings include:

• 211 attacks in total – 125 in Q1 and 86 in Q2
• 68 confirmed attacks – 45 in Q1 and 23 in Q2
• 143 unconfirmed attacks – 80 in Q1 and 63 in Q2
• 2,372,777 records are known to have been breached in the confirmed attacks
• Average ransom demand of $479,000
• The most prolific ransomware strains with the highest number of claims against healthcare companies were INC (34), Qilin (25), SafePay (14), RansomHub (13), and Medusa (13)
• INC and Qilin had the most confirmed attacks (10 each), followed by Medusa (7), RansomHub (6), and SafePay (4)

The research can be viewed at this link: https://www.comparitech.com/news/healthcare-ransomware-roundup-h1-2025/

Comparitech researchers have released a study looking at global ransomware statistics for the first half of 2025. With a breakdown of attacks per industry, per location, and per ransomware gang, this research found a 47% increase in ransomware attacks since 2024. 

Key findings for H1 2025 include: 

• 445 confirmed ransomware attacks
  • 260 were on businesses
  • 93 were on government entities
  • 52 were on healthcare companies
  • 40 were on educational institutions
• 3,182 unconfirmed attacks*
  • 2,783 were on businesses
  • 110 were on government entities
  • 161 were on healthcare companies
  • 90 were on educational institutions
• 17,070,617 records compromised in the confirmed attacks
• Average ransom demand of over $1.6M
• Akira was the most prolific ransomware group (347 victims – confirmed and unconfirmed), followed by Clop (333), Qilin (318), RansomHub (222), Play (214), and SafePay (186)
• The gangs with the most confirmed attacks were Qilin (40), RansomHub (27), Akira (25), SafePay (19), and INC (19)

The full research can be found here: https://www.comparitech.com/news/ransomware-roundup-h1-2025/

Rebecca Moody, Head of Data Research at Comparitech, provided the following commentary:

“We didn’t need any reminders of how stark the ransomware landscape is, but the fact that we’re seeing a 50 percent year-on-year increase in the number of attacks (when comparing H1 of 2024 to H1 of 2025) only serves to emphasize how companies, large and small, need to do everything they can to lower their risks of suffering from one of these attacks. Put simply–it’s not a case of if, it’s when.”

“While ransomware gangs continue to emerge, evolve, regroup, and change tactics, the basics around mitigating these risks remain the same. Keep software up to date, patch vulnerabilities as soon as they’re flagged, carry out regular system backups, have a plan in place if the worst should happen, and ensure staff are regularly trained.”

This should be a call to action for organizations big and small to do anything and everything to prevent ransomware attacks from being successful. Because the status quo of ransomware gangs running wild must not continue.

Comparitech researchers have released a study determining the most surveilled cities in the world. The research looks at the number of CCTV cameras per city and per population to discover which cities are the most watched. The study also outlines the ten most populated cities and their camera counts, the surveillance stats in US cities, and the correlation between CCTV cameras and crime count. 

Key findings include: 

• Hyderabad, Indore, Bangalore, Lahore, Seoul, Moscow, Kabul, Singapore, Saint Petersburg, and Baghdad are the top 10 most surveilled cities outside of China (based on the number of cameras per 1,000 people)
• A worrying number of cities are connecting private CCTV cameras to police networks, which is significantly increasing the number of “public” cameras across cities
• At the end of 2021, over one billion surveillance cameras were estimated to have been installed worldwide, according to IHS Markit’s latest report.
• 700 million cameras form the SkyNet project in China
• We found little correlation between the number of public CCTV cameras and crime or safety

You can see more details here: https://www.comparitech.com/vpn-privacy/the-worlds-most-surveilled-cities/

Comparitech researchers have released the May 2025 ransomware roundup. According to the findings, May was the quietest month this year so far with 457 in total attacks claimed by ransomware groups–down from 494 in April and about half February’s vast figure of 980.

The research dives into the number of attacks, industries impacted, as well as the most prolific gangs. 

Key findings include: 

• 457 attacks in total — 33 confirmed attacks
• Of the 33 confirmed attacks:
  • 19 were on businesses
  • 6 were on government entities
  • 2 was on healthcare companies
  • 6 were on educational institutions
• Of the 424 unconfirmed attacks:
  • 376 were on businesses
  • 13 were on government entities
  • 21 were on healthcare companies
  • 11 were on educational institutions
• The most prolific ransomware gangs were SafePay (71), Qilin (50), Play (44), Akira (32), NightSpire (16), and Devman (16). Qilin and Devman had the most confirmed attacks (three each), followed by SafePay, Dire Wolf, Interlock, and Gunra with two each
• Where hackers provide the data theft size (in 223 cases), over 75.8 TB of data was allegedly stolen, giving an average of 340 GB per breach

For full details, the report can be found here: https://www.comparitech.com/news/ransomware-roundup-may-2025/

Today, Comparitech researchers released a study looking into the salary and employment statistics of network administrators across the US. 

Since a network administrator plays a crucial role in ensuring the smooth and efficient operation of an organization’s IT infrastructure, it is interesting to see that the number of people is set to decline by -3 percent in the next 10 years. 

Average US-wide changes include:

• Average annual salary for network administrators increased by 0.6 percent from $100,580 (2023) to $101,190 (2024)
• # of people in network administrators roles decreased by 0.3 percent from 322,500 (2023) to 321,580 (2024)
• Employment per 1,000 people (the number of jobs in the given occupation per 1,000 jobs in the given area) decreased by over 8 percent from 2.22 (2022) to 2.04 (2024)
• # of vacancies available decreased by 24.5 percent from 7,354 (2022) to 5,552 (2025)
• 10-year growth projection for roles decreased from 3 percent for 2021-2031 to -3 percent for 2023-2033 (according to the latest BLS data)

For full details, including a breakdown of the differences of the network administration role across the United States, please see the study here: https://www.comparitech.com/net-admin/us-network-administrator-salary-employment-study/

Comparitech researchers have published a new study looking the average time it takes for organizations to report data breaches. With data from 2,600 attacks in the US since 2018, the researchers will analyze not only the average time it takes, but break it down across industries — education, healthcare, law, etc. — as well as by year. 

Some key findings include: 

• The average time to report a data breach following a ransomware attack is 4.1 months
• Ransomware attacks in 2023 saw the highest average data breach reporting time (5.1 months)
• Education had the highest average with over 4.8 months
• Healthcare had the lowest average with just under 3.7 months
• Businesses took an average of 4.2 months with those in the legal sector taking the longest (6.4 months)
• The longest known reporting period is 38 months
• States with specific timeframes for reporting a data breach had a slightly lower average reporting period than those without (3.9 months compared to 4.2 months)

The report can be read here: https://www.comparitech.com/news/average-data-breach-report-time-ransomware-attack/

Comparitech researchers have released a study looking at all the ransomware attacks in April 2025. April may have been quieter, but it did see some of the largest attacks so far this year. These include the ongoing attack on UK retail chain, Marks & Spencer and the crippling attack on US kidney dialysis company, DaVita Inc. 

Key findings for April 2025:

• 479 attacks in total — 39 confirmed attacks
• Of the 39 confirmed attacks:
  • 21 were on businesses
  • 9 were on government entities
  • 6 were on healthcare companies
  • 3 were on educational institutions
• Of the 440 unconfirmed attacks*:
  • 396 were on businesses
  • 16 were on government entities
  • 16 were on healthcare companies
  • 11 were on educational institutions
• The most prolific ransomware gangs were Qilin (67), Akira (62), Play (50), Lynx (32), and NightSpire (22). Akira had the most confirmed (3) followed by Qilin, NightSpire, Silent, and Sarcoma with two each
• RansomHub went “dark” in April, listing no new victims on its data leak site. Some suggest affiliates have moved to the likes of Qilin–and with a notable increase in claims from Qilin (up to 67 in April from 45 in March) this could be the case

The report is live at this link: https://www.comparitech.com/news/ransomware-roundup-april-2025/

The Charleston County, SC School District yesterday confirmed it notified 20,653 people about a July 2024 data breach. The district has not publicly disclosed what personal data was compromised, but it is suspected that Social Security numbers and/or other info that could be used for identity fraud were compromised. Ransomware gang RansomHub claimed responsibility for the breach in August 2024.

In a blog post reporting this news, Paul Bischoff, Consumer Privacy Advocate at Comparitech, wrote:

“RansomHub is a prominent cybercriminal gang that runs a ransomware-as-a-service business in which affiliates pay to use the group’s malware and infrastructure to launch their own attacks and collect ransoms. RansomHub started claiming attacks on its data leak site in February 2024. Since then, it’s claimed 136 confirmed ransomware attacks, compromising 6.5 million records. The group claimed another 631 unconfirmed attacks that haven’t been acknowledged by the targeted organizations.”

“In 2024, Comparitech researchers logged 75 confirmed ransomware attacks on US schools and colleges, compromising more than 2.8 million records. The average ransom is $876,000.”

“Ransomware attacks on schools and colleges disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay face extended downtime, lose data, and put students and faculty at increased risk of fraud.”

Other than healthcare, the education sector is low hanging fruit for threat actors. Both sectors need to be focused on so that this wave of ransomware attacks start to head in a more positive direction.