Recent Breaches
Breaches
View All →
Back to Threat Counter
44%

of breaches involve ransomware

Ransomware
The Digital Pandemic

Every 11 seconds, another organization is hit. Ransomware has evolved from simple encryption to a sophisticated extortion industry worth hundreds of billions.

44%

Ransomware present in breaches

£2.2M

Average ransom payment 2024

£210B

Projected cost by 2031

11 sec

one attack

Attack frequency

Evolution

Ransomware has become an industry

Stage 1

Encryption

Traditional ransomware encrypts files and demands payment for the decryption key. Simple but effective.

Example: WannaCry (2017) - Encrypted 200,000+ systems in 150 countries in one day

Stage 2 - Double Extortion

Data Exfiltration

Modern ransomware steals data before encrypting. Pay to decrypt AND pay to prevent public leak. Two ransoms.

Example: REvil pioneered this, now used by 77% of ransomware groups

Stage 3 - Triple Extortion

Business Disruption

Attack customers, partners, and suppliers. DDoS attacks on top of encryption and data theft. Maximum pressure.

Example: Vastaamo psychotherapy center - patients directly extorted after provider breach

The Industry

Ransomware-as-a-Service

Ransomware is now a business. Groups sell tools and share profits with affiliates. Low-skill attackers can launch sophisticated attacks.

Example: LockBit operates like a franchise, with affiliate programs and customer support

Recent Attacks

No organization is immune

Hospitals, governments, Fortune 500 companies. Ransomware does not discriminate.

Change Healthcare

2024

100M+ patient records exposed

Ransom

£17.5 million paid

Downtime

Weeks of healthcare disruption

MGM Resorts

2023

£79 million in losses

Ransom

Refused to pay

Downtime

10 days of casino operations down

Royal Mail

2023

International shipping halted

Ransom

Refused £63M demand

Downtime

6+ weeks of disruption

City of Dallas

2023

Police, court systems offline

Ransom

£6.7 million cost

Downtime

30+ days to restore services

Backups aren't enough.
Go offline.

Modern ransomware targets backups first. Connected backups can be encrypted or exfiltrated. Only truly offline storage is immune to ransomware's reach.

Mark Fermor
David Bailey
Kenny Phipps
Online Now
Concierge

Make ransomware irrelevant to your business

Discover how offline storage creates an impenetrable backup that ransomware simply cannot reach.

Takes about 2 minutes. No account needed.

Free2 minsNo sign-up

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy

    Firevault

    Firevault is Offline Secure Storage. Hardware you own, physically disconnected by default, with KYC-verified access. Ransomware-proof by design, not by patch.

    © 2026 Firevault Limited. Disconnect to Protect®