Summary Bullets:
• Fueled both by its lucrative results and AI-driven toolkits that lower the barrier of entry for enterprising yet inexperienced bad actors, ransomware incidents are soaring.
• In 2024, ransomware drove 44% of data breaches around the world and accounted for 54% of those in APAC, according to the 2025 Verizon Data Breach Investigations Report (DBIR).
As is the case with any IT security breach, it is no longer a question of if but when an enterprise might be hit with ransomware. Motivated in large part by profit potential, cybercriminals are drawn to ransomware as a mechanism to extort money. As a result, ransomware incidents are on the rise with the 2025 Verizon DBIR finding the number has increased 37% in 2024 versus the prior year.
In Akamai’s newly-published 2025 State of the Internet/Security research, security and content delivery network (CDN) provider Akamai attributed this surge to a number of factors, including AI. Examining incident data from its secure internet access enterprise clients, Akamai shows a strong correlation between the increased availability of GenAI and large language models (LLMs) tools. This makes it easier for less seasoned bad actors to mount highly effective ransomware operations. Cybercriminals use LLMs to generate code and enhance their social engineering techniques.
While money is a powerful motivator in ransomware campaigns, the Akamai research notes hacktivism is also part of the picture. The increasing prevalence of ransomware-as-a-service (RaaS) is one indicator of this. RaaS leverages a sprawling underground network that uses developers, the zero-day market, and initial access brokers. These organized crime entities specialize in particular functions like money laundering to fund activities pursuing sociopolitical or ethical goals.
Threat actors are also becoming more aggressive in their extortion efforts, increasingly applying double extortion, in which cybercriminals move beyond breaching an organization to encrypt data and then demanding payment to decrypt it, has become commonplace. In double extortion breaches, cybercriminals promise to release data elsewhere if not paid. Triple extortion, leveraging DDoS attacks to add more incentive for the targeted organization to pay the ransom, is also a more frequently used tactic than in the past.
Akamai notes that it has found incidents that use quadruple extortion, in which cybercriminals communicate with executives, other employees, partners, and the media to add more pressure to pay. Some criminal organizations also threaten to expose lack of regulatory compliance to authorities to up the ante. It is worth noting that some cybercriminals release the data anyway or come back for more ransom money. There is no honor among thieves.
The effectiveness of cybercriminals in collecting ransom has had a ripple effect on cyber insurance rates and an increased frequency of IT security audits by firms to ensure the appropriate controls are in place.
The challenge of staying one step ahead of the threat actors has never been more daunting. Budget holders need to prioritize the resources to make it possible for security practitioners to do so, or risk the consequences.