Ransomware and Data Extortion in 2026: Trends and How to Prepare

Hero Summary

Ransomware is malicious software that blocks access to systems or data until a payment is made, and modern campaigns increasingly pair encryption with the threat of publishing stolen data. The FBI's Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints in 2025 — up from 3,156 in 2024 and 2,825 in 2023 — and identified 63 new ransomware variants during the year, an average of 5.25 per month. Reported losses exceeded $32 million, but the FBI notes that this understates the real cost, because it normally excludes lost business, wages, equipment, and remediation. The most effective defences are well-understood: tested offline backups, multi-factor authentication, patching of internet-facing systems, segmentation, monitoring, and a rehearsed response plan.

Executive Summary

Ransomware has become a business with specialised roles, rapid turnover of groups and tools, and pressure tactics beyond encryption. This guide uses the FBI's 2025 report as its factual spine: how many incidents were reported, which sectors were most affected, why reported losses are an undercount, what the FBI recommends, and how those recommendations translate into a practical program for Indian organizations that also face CERT-In's six-hour reporting rule and the DPDP Act's breach-notification duties.

What the 2025 data shows {#data}

According to the FBI IC3 2025 Internet Crime Report:

• IC3 received 3,611 ransomware complaints in 2025, compared with 3,156 in 2024 and 2,825 in 2023.
• Reported ransomware losses exceeded $32 million in 2025.
• IC3 identified 63 new ransomware variants during the year, an average of 5.25 new variants per month.
• The ten most frequently reported variants accounted for 56.8% of reported ransomware incidents.
• Ransomware is among the highest reported cyber threats targeting critical infrastructure organizations, and the top ten variants most affected critical manufacturing, healthcare and public health, and government facilities.
• IC3 also received more than 1,400 ransomware complaints from organizations outside the critical sectors, most often legal services (18%), contracting services (17%), engineering and architectural services (10%), consulting services (7%), and non-critical manufacturing (5%).

IC3's separate "extortion" crime type recorded 89,129 complaints and $122,499,133 in reported losses in 2025.

Why reported losses understate the cost {#undercount}

The FBI is explicit that the ransomware loss figure is artificially low. Its report notes that the figure does not normally include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services; that in some cases entities report no loss amount at all; and that the number only represents what entities report to IC3 and not what they report directly to FBI field offices. For planning, treat the reported loss as a floor. The true cost to a victim usually includes downtime, recovery, investigation, legal and regulatory work, customer notification, and reputational damage.

From encryption to extortion {#extortion}

Early ransomware focused on encrypting files and demanding payment for a decryption key. Many attackers now also steal data before encrypting it and threaten to publish or sell it, which is why the problem is often described as data extortion or double extortion. This changes the defender's position in two ways:

• Backups alone do not solve it. Restoring from backup removes the encryption problem but not the threat of publication.
• It becomes a data breach. Stolen personal data triggers notification duties and regulatory exposure, whether or not systems were encrypted. See Data Breach Response Under DPDP.

Some attackers skip encryption entirely and use theft and threats alone.

Who is being targeted {#targets}

The FBI data shows ransomware is not limited to large enterprises or one sector. Critical manufacturing, healthcare, and government are the most affected critical sectors, and a large share of complaints come from professional-services firms such as law and engineering practices — organizations with valuable client data and often smaller security teams. Healthcare is especially exposed because downtime affects patient care; see Cyberattacks on Indian Hospitals.

How attacks typically unfold {#chain}

While details vary, ransomware intrusions commonly follow a pattern:

1. Initial access — phishing, stolen or reused credentials, or exploitation of an internet-facing vulnerability. See Exploitation of Internet-Facing Systems and Identity Attacks.
2. Establishing a foothold and escalating privileges.
3. Moving laterally across the network and locating valuable data and backups.
4. Stealing data.
5. Disabling defences and backups.
6. Deploying ransomware and making demands.

Each stage is an opportunity to detect and stop the attack, which is why monitoring and segmentation matter as much as prevention.

What the FBI recommends {#fbi}

The FBI's report lists these mitigating practices for companies:

• Create off-site or offline backups and regularly maintain backup and restoration; ensure backup data is encrypted, immutable (cannot be altered or deleted), and covers the entire organization's data infrastructure.
• Eliminate default passwords and credentials, and require all accounts with password logins — including service, admin, and domain admin accounts — to comply with NIST standards.
• Disable and remove unnecessary protocols, audit administrative accounts, and apply least privilege.
• Enable multi-factor authentication for all services to the extent possible, particularly webmail, virtual private networks, and accounts that access critical systems.
• Secure initial access points with tools that log and report network traffic, including lateral movement; endpoint detection and response tools are particularly useful for detecting lateral connections.
• Segment networks to prevent the spread of ransomware and restrict lateral movement.
• Keep operating systems, software, and firmware up to date, and prioritize patching known exploited vulnerabilities in internet-facing systems.

The FBI also asks victims to report to IC3 and points to CISA's #StopRansomware guide for a fuller list of mitigations.

Preparing in practice {#prepare}

1. Test your backups. Restore a critical system end to end, from offline or immutable copies, and time it. Untested backups are a hope, not a plan.
2. Know your crown jewels. Identify the systems and data whose loss would stop the business, and protect them first.
3. Close the common doors. Patch internet-facing systems, enforce MFA on remote access and email, and remove exposed management interfaces. See Firewall Configuration Best Practices.
4. Segment the network so one compromised workstation cannot reach everything.
5. Monitor around the clock. Early detection of unusual activity can stop an intrusion before encryption. See SOC as a Service.
6. Train people to recognize and report phishing. See Phishing Attacks: Types, Warning Signs & Prevention.
7. Test your defences with VAPT and review what an attacker could reach. See Network VAPT.
8. Write and rehearse a response plan covering decisions, communications, legal, regulator and CERT-In reporting, and the question of whether to pay — decided in advance, with legal and executive input, not under pressure.
9. Review insurance and vendor contracts so you know what support is available and what exclusions apply.

Indian reporting duties {#india}

CERT-In's April 2022 directions require covered entities to report specified cyber incidents within six hours of noticing them and to keep ICT system logs for 180 days. If personal data is affected, the DPDP Act and Rules add duties to notify the Data Protection Board and affected individuals, with most obligations phased in around May 2027. Sector regulators such as the RBI and SEBI have their own expectations. Build one response plan that covers all of them.

If an attack happens {#response}

1. Isolate affected systems from the network to limit spread, without powering them off unless advised, to preserve evidence.
2. Activate your incident response plan and bring in specialists early.
3. Preserve evidence — logs, ransom notes, and affected systems.
4. Report to law enforcement and regulators as required — in India, to CERT-In and, for cybercrime, the National Cyber Crime Reporting Portal (cybercrime.gov.in); in the US, to IC3.
5. Assess what data was accessed or stolen to decide notification duties.
6. Restore from clean backups only after the attacker's access is removed, so reinfection does not occur.
7. Review and improve once operations are restored.

How Threat ResQ fits {#threat-resq-fit}

• SOC+, Threat ResQ's managed detection and response platform, provides 24x7 monitoring and alert triage by a live analyst team, with correlated detection across endpoint, network, and identity signal.
• The Incident Response service provides on-call containment, forensic investigation, and recovery support.
• The VAPT service tests networks, applications, and APIs, delivered in collaboration with a CERT-In empanelled security firm; the empanelment belongs to that partner, not to Threat ResQ itself.
• TRISA and TRAP address the phishing and social-engineering route in.

FAQ {#faq}

How common is ransomware? The FBI's IC3 received 3,611 ransomware complaints in 2025, up from 3,156 in 2024 and 2,825 in 2023, and identified 63 new variants during the year. These are reported incidents only, so the true number is higher.

How much does ransomware cost? IC3 recorded more than $32 million in reported ransomware losses for 2025, but the FBI notes this normally excludes lost business, wages, equipment, and remediation costs and relies on voluntary reports, so actual costs are higher.

What is double extortion? A tactic in which attackers both encrypt data and steal it, threatening to publish it if the ransom is not paid. It means restoring from backup does not remove the pressure.

What does the FBI recommend to protect against ransomware? Offline or immutable tested backups, removing default credentials, least privilege, multi-factor authentication for all services to the extent possible, monitoring and endpoint detection, network segmentation, and timely patching, prioritizing known exploited vulnerabilities in internet-facing systems.

Do I have to report a ransomware attack in India? CERT-In's April 2022 directions require covered entities to report specified incidents within six hours of noticing them. If personal data is affected, DPDP and sector regulators add further duties.